topic Re: Report on Rule Usage? in General Topics

Report on Rule Usage?

apc050 — Wed, 29 Jun 2011 15:20:34 GMT

Hi,

How can I run a report to understand the last use of a loaded policy/security rule? For example, if I have 100 security rules in the firewall policy, how can I identify which rules are actively being used, and which ones are not being used often, or at all? I realize that this information is contained within the traffic log, but for an environment whose log rention is not very long (50 days) is there another metric I can generate a report on to see when rules are being used?

Thanks,

-Paul

Re: Report on Rule Usage?

bpappas — Wed, 29 Jun 2011 15:51:23 GMT

show running rule-use rule-base security type unused vsys vsys1 (replace vsys1 with the appropriate vsys name)

-Benjamin

Re: Report on Rule Usage?

apc050 — Wed, 29 Jun 2011 17:23:09 GMT

Thank you Benajmin. This is pretty much exactly what I was looking for. Now is there any additional modification that can be made to show not only the rules that have NEVER used, but also those that haven not been used in a while, and include the last date/time that the rule was triggered?

Re: Report on Rule Usage?

spolo — Thu, 07 Jul 2011 18:08:10 GMT

I think your next option here is to review logs and start filtering on dates or rules you might question. There's currently not a report like that one for "infrequently" used rules. If you have particular rules you'd like to clean up, you could potentially create a custom report for utilization of just those particular rules, and run it against your desired time frames. Hope this helps!