topic Re: Highlight unused rules after device restart in General Topics

Highlight unused rules after device restart

M.Alzahaby — Fri, 12 Jun 2015 22:01:10 GMT

Hello,

Is there any way to know unused rules after device restart? Can the PA dig into available logs and recount?

Re: Highlight unused rules after device restart

pulukas — Fri, 12 Jun 2015 22:32:07 GMT

The highlight unused rule function clears with a system reboot. This only measures whether a rule was used or not since the most recent reboot.

There is no way to adjust the operation or parameters of this feature.

Re: Highlight unused rules after device restart

M.Alzahaby — Sat, 13 Jun 2015 11:05:13 GMT

Hello Steven,

There may not be a way now but the migration tool can run reports for rules to get applications. Can this be used to check unused rules?

if there a traffic hits a rule in log, set counter+1 for example.so even after a reboot unused rules will have counter 0 And used rules will have minimum counter of 1.

Re: Highlight unused rules after device restart

pulukas — Sat, 13 Jun 2015 13:38:21 GMT

I've only used the migration tool a couple times. But from what I've seen this only deals with the configurations. It seems like the approach you suggest would require some kind of log preservation and report. And this tool is designed for migrations and application rule changes.

Seems like the better outside tool for this type of report would be to ship all syslog to a log server and create reports from there.

In any case the current unused rule feature in PanOS only performs the simple task of noting if a rule has ever been hit since the last reboot of the system, nothing more. This is not a hit counter in the traditional sense.

Re: Highlight unused rules after device restart

VinceM — Tue, 16 Jun 2015 15:44:20 GMT

Hi,

What you can do, if you don't want to reboot your FW every day :-), is to create custom report based on "Rule" and "Repeat Count".

Check the report every day and see is which are the rule with no change.