topic Re: How to identify long live session(s) ? in General Topics

How to identify long live session(s) ?

nextgenhappines — Sat, 25 Jun 2016 11:56:14 GMT

Hello,

I am trying to identify those long live sessions on my firewall, I mean those session(s) that never ended for weeks at a time.

This is what I found out so far.

1. I can't export the whole session log to perform offline analysis,

2, I did not find anything related to session start time as filter under show session all filter.

3. ACC will only record when a session is closed, I don't believe ACC will show that session data (session #, packets used, bytes used) until the session is ended.

Any suggestion?

Thanks in advanced,

Re: How to identify long live session(s) ?

Raido_Rattameister — Sat, 25 Jun 2016 15:25:28 GMT

I think session table shows up to 1024 sessions at once.

If you don't have too many sessions then you could export from cli.

show session all start-at 1

show session all start-at 1025

etc

By the way ACC data comes directly from dataplane and it does not matter if sec policy has "log at session start" and "log at session end" checked - ACC still shows everything. ACC is not real time - it has 15 min delay.

Re: How to identify long live session(s) ?

nextgenhappines — Sat, 25 Jun 2016 17:53:19 GMT

Raido,

I thought about that, but the firewall have about 1 million active sessions +/- 250k at any given time. I was trying to look up how does ACC work, do you have a link to a techdoc? For sure, I am seeing long live session does not show up on ACC until the session is closed.

-E

Re: How to identify long live session(s) ?

emr_1 — Mon, 27 Jun 2016 05:50:22 GMT

How about using custom report?

If you select 'traffic log (detailed log, not summary database), you can use one column named 'elapsed time (sec)'.

Re: How to identify long live session(s) ?

Raido_Rattameister — Mon, 27 Jun 2016 10:33:07 GMT

In this case all security policies should have "log at session start" that is not default.

It is nice option but writes a lot more log and log retention period is shorter.

Re: How to identify long live session(s) ?

nextgenhappines — Mon, 27 Jun 2016 14:00:04 GMT

I will need to try the custom report. Thanks for the tips.

Re: How to identify long live session(s) ?

William-Wu — Wed, 10 May 2023 19:42:18 GMT

How about using the XML API calls on the firewall and filtering by min-age?

604800 seconds is a week.

/api/?type=op&cmd=<show><session><all><filter><min-age>604800</min-age></filter></all></session></show>