Rule Hit is 0

kraszkie — Tue, 12 Jan 2021 09:38:53 GMT

Hello,

I would like to use Expedition (1.1.89) to clean up my rules on PA.I have a lot of 0 hit count rules in FW and I want to deleted them by multi edit. Now after import configuration from Palo Alto (Pan OS 9.1.5) I see in project->Polices that I have 0 Rule hit on all rules (I also try to retrieve rule hits).

How to import configuration form PA with real usage of rules ?

Logs from panReadOrders.log

Checking: ApiRuleHitsReport
Tue, 12 Jan 2021 03:26:59 -0600 Start Task

Warning: Error while sending STMT_PREPARE packet. PID=18496 in /var/www/html/libs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php on line 77
Tue, 12 Jan 2021 03:26:59 -0600 End Task

Re: Rule Hit is 0

dgildelaig — Tue, 12 Jan 2021 09:51:46 GMT

My guess is that you still need to request the hit information.

The configuration itself does not contain hit counts, so you need to make a request to the FW to get the hit-counts.

This action is within the contextual menu that you get by right-clicking on the security rules: "PanOS Device -> Retrieve Rule-Hit"

Make sure you have defined the log connector to be able to request this information to your firewall (under Plugins tab)

topic Re: Rule Hit is 0 in Expedition Discussions

Rule Hit is 0

Re: Rule Hit is 0