topic Re: max session count in a month in General Topics

max session count in a month

Gururaj — Mon, 16 Nov 2015 10:43:04 GMT

Hi All,

I want to find maxmimum session count reached in the past month. Now the PA device is not live, so i cannot find the current/live session count from the dashboard.

Under monitor > App Scope > network monitor i can get the traffice detail for the session count but it is showing number session for the whole day. I have attached the screenshot of the same for your reference.

And also created a report for number of session in any any allow rule(in virutal wire deployment), but report is generated for the whole 15 minutes(not less time than 15min), wecant find the peak value.

Can someone help me to get Maximum session count reached for the past month or any specific time.

with regards,

Ram.

Re: max session count in a month

Raido_Rattameister — Mon, 16 Nov 2015 11:11:25 GMT

From cli:

grep dp-log dp-monitor.log pattern "Number of active sessions"

Re: max session count in a month

Gururaj — Tue, 17 Nov 2015 07:09:24 GMT

Hi Raido,

Now the device is not in production/live, so active session details are not shown. I ran the commands and all the results were showing 0.

Can you give some command to find active sessions on the particular time period.

with regards,

Ram

Re: max session count in a month

Raido_Rattameister — Sat, 21 Nov 2015 22:25:16 GMT

less dp-log

then either tab or ?

you should see older files also (like dp-monitor.log.2 and dp-monitor.log.3)

and then change command accordingly

grep dp-log dp-monitor.log.2 pattern "Number of active sessions"

if you use command

less dp-log dp-monitor.log

then you see full file.

type command below to see timestamps when session counts were taken

grep dp-log dp-monitor.log.2 pattern "panio"

Re: max session count in a month

mikand — Sun, 22 Nov 2015 00:15:14 GMT

You can do "repeat count" from the traffic log and generate a report with resolution of 15 minutes slots (which seems to be the lowest?) as described in https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-got/td-p/67945/page/2 (this particular link is about the same topic but limited to SSL - in your case just remove "appid:ssl" from your report and you should get the total amount of sessions per timeslot).

Note however that I think this is number of ENDED sessions during this timeslot, not necessary number of concurrent sessions.

I guess you would need to file this as a feature request that the AAC and report engine should log number of concurrent sessions (per appid or so) and add resolution of lets say once a minute to get a more detailed "performance graph" when it comes to concurrent sessions.

Another workaround might be if the current session count can be readout through SNMP (or in worst case through RESTAPI) and then in realtime graph this - but the thing is that you shouldnt have to rely on external components, the AAC should be able to do this on its own.