The command "Show systems statistics session" in a daily report?

RandomDisplayName — Tue, 25 Jun 2019 20:07:15 GMT

I would like the information displayed in the "Show systems statistics session" CLI command to be packaged into a daily report so that I could see the previous day's throughput, packet rate, TCP sessions, etc and displayed in nice line graphs. Is there such a report?

Thanks!

Update

I solved this by using the XML API and a Powershell script (below) which is attached to a scheduled task that executes every minute. I found that the "show session info" command, and its API analog, shows the same info as the "show system statistics session" but in a passive format. Using the XML API and a script I exported the "show session info" data to XML and parsed it into a nice CSV file. I'm going to let the script collect data for a few weeks and then I'll take the resutling CSV files and chart their data in Excel.

Here's the script I used:

$paloList = "palo1.example.com","palo2.example.com"
$queryUri="/api/?type=op&cmd=<show><session><info></info></session></show>&key=API KEY GOES HERE"
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f "USERNAME","PASSWORD")))

$results =@()

foreach($fw in $paloList)
{
    $fullUrl="https://"+$fw+$queryUri
    try
    {
        [xml]$systemStats = Invoke-WebRequest -uri $fullUrl -Method Get -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}
    }
    catch
    {
        Write-Host "StatusCode:" $_.Exception.Response.StatusCode.value__ 
        Write-Host "StatusDescription:" $_.Exception.Response.StatusDescription
    }

    [object]$statsInfo = $systemStats.response.result | Select-Object pps,kbps,num-active,num-icmp,num-tcp,num-udp

    $results += New-Object -TypeName psobject -Property @{
            "Date"=get-date -Format "MM-dd-yyyy";
            "Time"=get-date -Format "hh:mm:ss";
            "Packet rate"=$statsInfo.pps;
            "Throughput"=$statsInfo.kbps;
            "Total active sessions"=$statsInfo.'num-active';
            "Active TCP sessions"=$statsInfo.'num-tcp';
            "Active UDP sessions"=$statsInfo.'num-udp';
            "Active ICMP sessions"=$statsInfo.'num-icmp'}

    $filename = $fw+"_statsInfo.csv"
    $results | select Date,Time,"Packet rate",Throughput,"Total active sessions","Active TCP sessions","Active UDP sessions","Active ICMP sessions" | export-csv $PSScriptRoot\$filename -NoTypeInformation -Append
}

-Note 1: I have multiple devices that I'm pulling data from hence the loop.

-Note 2: You need to get yourself an API key for your device. I found that an API key from one device worked on another, but YMMV.

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key#

-Note 3: The resulting CSV file is saved to the same folder as the script.

-Note 4: The data is appended to the CSV file(s).

Re: The command "Show systems statistics session" in a daily report?

BPry — Sat, 15 Jun 2019 22:38:43 GMT

@RandomDisplayName,

This isn't something that is readily available, however you could make it yourself if you log the output and then make the graphs with the information you have stored.

Re: The command "Show systems statistics session" in a daily report?

reaper — Fri, 21 Jun 2019 08:55:06 GMT

this command provides a snapshot of the current throughput of the system, displaying this on a daily basis would skew you statistics (packets per second averaged out over 86400 seconds per day) if you want a tally of the days totals you can create a report that lists the amount of packets and bytes received/transmitted alternatively you can monitor the system via SNMP and graph out the usage on an external RRDtool like cacti

topic Re: The command "Show systems statistics session" in a daily report? in General Topics

The command "Show systems statistics session" in a daily report?

Re: The command "Show systems statistics session" in a daily report?

Re: The command "Show systems statistics session" in a daily report?