topic Custom Report for Unused Policies in General Topics

Custom Report for Unused Policies

jambulo — Tue, 18 Nov 2014 14:30:17 GMT

Anyone have any tips on how to create a report to list unused policies?

Re: Custom Report for Unused Policies

HULK — Tue, 18 Nov 2014 14:45:15 GMT

I don't see a direct option to generate report for only unused rule:

How to Identify Unused Policies on a Palo Alto Networks Device

Re: Custom Report for Unused Policies

ssharma — Tue, 18 Nov 2014 14:51:57 GMT

Hi jambulo ,

The unused rule counter is based off the dataplane since the last restart. That means once the device is up and running and one of the rule is never triggered, then that is considered unused rule. Currently there is no way to generate a custom report based on that as it will never generate any report. You can view it on security policy only. Hope this helps. Thank you.

Re: Custom Report for Unused Policies

Retired Member — Tue, 18 Nov 2014 16:46:45 GMT

Look for used rules related to your log capacity,if you have panorama it'll be better.it will give an idea about unused rules.

Re: Custom Report for Unused Policies

hshah — Tue, 18 Nov 2014 19:15:03 GMT

Hi Jambulo,

Custom report will not help to determine unused rules. Only following document will help for that.

How to Identify Unused Policies on a Palo Alto Networks Device

Custom report is something used to get daily update of aggregated logs, You need information about unused policy just once. Hence you can use above document.

Regards,

Hardik Shah

Re: Custom Report for Unused Policies

Retired Member — Tue, 18 Nov 2014 19:28:33 GMT

Hi Hardik,

so if the rule is not listed here

https://live.paloaltonetworks.com/docs/DOC-4229

it is also maybe used at selected time(if I select 1 year) at once you mean ?

I need that info also

Thanks