topic Re: What the different between 'count' and 'repeat count' in the report? in General Topics

What the different between 'count' and 'repeat count' in the report?

Kanitin — Thu, 01 Sep 2016 15:04:13 GMT

Hi everyone,

I need to know the diffrent between 'count' and 'repeat count' in the report. I found the description of 'repeat count' in the Admin Guide only, but can't found 'count'.

- Repeat Count (repeatcnt): Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds; used for ICMP only

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/syslog-field-descriptions.html

Does anyone have any details of this?

Best regards,

Re: What the different between 'count' and 'repeat count' in the report?

reaper — Fri, 02 Sep 2016 12:56:19 GMT

Hi!

correct me if i'm wrong, but i think you're mixing the log field format with the available collumns in the reports

'count' is used in reports to count how many times a contextual object is seen in the timeframe of the report

while 'repeat count' is a log field that indicates only 1 log was written for X repeats of identical ICMP sessions in 5 seconds

Re: What the different between 'count' and 'repeat count' in the report?

mikand — Wed, 07 Sep 2016 18:01:08 GMT

As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace).

Count is the number of log entries (rows) you have located.