topic Re: Highlight Unused Rules in General Topics

Highlight Unused Rules

fmd — Tue, 05 Apr 2011 21:46:34 GMT

We're running 4.0.1 in a test environment. We have a large Checkpoint rulebase that we will export. It ideally needs a rule tidy up to remove unused rules and objects.

Can someone describe how the "Highlight Unused Rules" tick box option on the policy page works. Yep, I know it sounds obvious!! But what is it based on - the logs? If so how far back in the logs will it go? Is there then a way of quickly removing unused objects that aren't in rule? etc.

Thanks

Re: Highlight Unused Rules

mderksen — Wed, 06 Apr 2011 06:51:18 GMT

Hi,

The options shows you the unused since the last restart of the system. So you need to have it pass traffic and execute rules before you can see which rules are used or not.

Marcel

Re: Highlight Unused Rules

fmd — Wed, 06 Apr 2011 09:59:35 GMT

Thanks Marcel. I'm running Panorama to manage the PA4050s - when you say system restart what exactly do you mean. Eg. I have Panorama receiving logs - I have 3 months worth of logs - the policy config is saved, committed on Panorama and pushed to the PA4050s every week for rule changes. Neither the PAs or the Panorama server or software has been rebooted during that time. When clicking the "Highlight Unused Rules" on Panorama - would I get a full view of what rules didn't see traffic during that 3 month period?

If Panorama was rebooted for some reason - but I still had the logs on Panorama - what would happen if I selected the "Highlight Unused Rules" option then on Panorama?

Many thanks

Re: Highlight Unused Rules

mderksen — Wed, 06 Apr 2011 15:05:44 GMT

Hi,

When you select the context of the unit in Panorama and click on the unused rule you will see which have not been hit since the moment you rebooted the unit.

Marcel

Re: Highlight Unused Rules

n.barria — Wed, 10 Feb 2016 08:08:44 GMT

hi is there a way to possibly export the unused policies on an excel?

Re: Highlight Unused Rules

reaper — Wed, 10 Feb 2016 08:48:37 GMT

you can spawn a simple list using the CLI command:

show running rule-use vsys <value> rule-base <security|nat|qos|pbf|decryption|app-override|cp|dos> type <used|unused>

eg:

> show running rule-use vsys vsys1 rule-base security type unused 

rule1
unusedrule1
unusedrule2