topic policy rules hit in General Topics

policy rules hit

NLughmani — Mon, 16 Jun 2014 07:00:03 GMT

Hello folks,

Currently if I need to find out if a particular rule is being hit or not I use the following filter under monitor tab.

( rule eq 'nameOfRule' )

Obviously it gives lot of good information with a reasonable detail. I was wondering if there is another way of finding out how many hits a particular rule has hit so far without going into too much details.

Thanks,

Nadeem

Re: policy rules hit

ajbool — Mon, 16 Jun 2014 07:37:19 GMT

I asked my Palo Alto SE about rule counts recently and he informed me that they've been included in PANOS 6 - I've not as yet upgraded to check. Perhaps worth a look.

Also, did you know of the following command?

show running rule-use rule-base security type unused vsys vsys1

Re: policy rules hit

reaper — Mon, 16 Jun 2014 07:40:23 GMT

Hi Nadeem

you may want to check out the reports. There is one that will show you the amount of bytes and sessions per rule

Re: policy rules hit

NLughmani — Mon, 16 Jun 2014 07:51:52 GMT

I have not tried this command, I will give it a shot.

Re: policy rules hit

NLughmani — Mon, 16 Jun 2014 07:52:54 GMT

Hi tpiens,

This is close to what I was looking for. Screenshot is definitely helpful.

Thanks

Nadeem

Re: policy rules hit

jkim2 — Tue, 24 Jun 2014 13:12:29 GMT

Under policies at the bottom there is a "highlight unused rule" checkbox that is also helpful . as mentioned you can also use the cli command "show running rule-use rule-base security type unused vsys vsys1" and do diff's