topic Re: Finding unused objects in policies in General Topics

Finding unused objects in policies

JohnT — Thu, 24 Feb 2022 17:19:45 GMT

Hi,

I'm wondering if there's a way to see when an object last had a hit on it? I know there is for security policies, but I'm wondering about specific objects.

We don't have Panarama, and I'm just thinking about creating a new syslog server to capture historical data(going forward) to find these unused objects. I'm hoping that there's some kind of cli that may show this information.

any thoughts thanks

John

Re: Finding unused objects in policies

jdelio — Thu, 24 Feb 2022 22:29:07 GMT

You are wanting to know not only what rule was used, but more specifically when a certain object was used in that rule?

Re: Finding unused objects in policies

BPry — Fri, 25 Feb 2022 02:21:07 GMT

@JohnT,

There's nothing that I'm aware readily available to do anything like this on the firewall. You can always attempt to simply delete the object in question (or all/any object), the firewall will present an error message for any object still referenced in the configuration and prevent you from removing it.

Re: Finding unused objects in policies

JohnT — Tue, 04 Oct 2022 13:03:04 GMT

I can find what rules an object belongs to, what I'm looking for is when was an object last hit. For example, I have object 11.11.11.11 used in a policy, when did it get hit in the policy last 1 hour ago or 2 years ago. thanks John