topic User ID Count in Automation/API Discussions

User ID Count

Sjoerd — Fri, 21 Jul 2017 10:06:42 GMT

Im using this operational command to pull out the number of mapped users by the user id:

<show><user><ip-user-mapping><all><option>count</option></all></ip-user-mapping></user></show>

This was working fine till I upgraded to PAN OS 8.

the operational command <show><user><ip-user-mapping><all></all></ip-user-mapping></user></show> still give the correct result (i have to strip the count option out) but the output is way to large since it also show all of the users.

Is this a bug, or is there a new way to find only the number of mapped users?

Re: User ID Count

BPry — Fri, 21 Jul 2017 16:45:13 GMT

@Sjoerd,

The count option should still be working perfectly fine in PAN 8 OS 8. I can run it on my PA-200 and PA-220 in my lab and get the user count perfectly fine. You might be running into something on your box that is preventing you from getting the output. If you run it directly from the CLI do you get the proper output?

Re: User ID Count

nigelswift — Fri, 21 Jul 2017 16:56:37 GMT

I was able to verify this as well ("show user ip-user-mapping all option count" returns nothing for PAN-OS 8.0, but does for PAN-OS 7.1). However, as you said, "show user ip-user-mapping all" does return the count.

I ran both queries against PAN-OS 8.0 100 times (4000+ user mappings on firewall)

"show user ip-user-mapping all option count" averages 0.108 seconds

"show user ip-user-mapping all" averages 0.207 seconds

Being that the difference is only 0.1 seconds, you should be able to do the same function as before by doing the "show user ip-user-mapping all" by parsing the XML for the count. If you're using Python, the xml.etree.ElementTree native library should take care of this easily.