Is there a way to tell if a service is being used? I am trying to verify that the services the migration tool lists as unused can be deleted. It might be enough to go by what the migration tool says but I usually like to verify it a couple different ways.
Would trust the migration tool. Its checking the xml for occurrances of the named object. If its not in the config it highlights it.
There's another handy bit of kit called the configurator. If you can get you head around the coding its very useful.
There's one cmd to delete all unused objects. If ye can delete them ye can probably parse them as well. All depends on how many ye have. 10 / 20 can check manually in the xml file yer self. 100's or 1000's maybe try sus out the configurator..
is open source, as far as I know a pan engineer developed it and maintains it..
some example of the code below
Delete unused objects from a config :
foreach($pan->addressStore->addressObjects() as $object ) if( $object->countReferences() == 0 ) $pan->addressStore->remove($object);
Want to know where an object is used ?
$object = $pan->addressStore->find('H-WebServer4'); foreach( $object->getReferences() as $ref ) print $ref->toString()."\n";
and if you want to double-double check you can do a "Global Find" (top right search box or drop-down option on the service) that will search through your entire config and highlight all the places the object appears:
regarding the solution mentioned above by using the pan-configurator:
I recommend the util script which are coming with the pan-configurator:
php service-edit.php in=api://[DEVICE-MGTM-IP] actions=delete 'filter=(object is.unused.recursive)'
With this your changes are done against the configuration available on your Palo Alto Networks firewall.
It is also possible to manipulate an offline PAN-OS config file:
php service-edit.php in=[INPUT-FILE].xml out=[OUTPUT-FILE].xml actions=delete 'filter=(object is.unused.recursive)'
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!