Network Monitor Graph Shows High Bandwidth Usage but ACC Doesn't

Network Monitor Graph Shows High Bandwidth Usage but ACC Doesn't

51471
Created On 09/25/18 19:54 PM - Last Modified 06/08/23 09:42 AM


Resolution


Issue

The Network Monitor graph shows a higher number of bytes consumed over time for a certain application while the selected application shows a different value from the ACC tab.

 

Resolution

  • Network Monitor Graph and ACC retrieve data from different sources, so it's normal to see different values.
  • The Network Monitor includes the Appstat database--essentially counters on the dataplane. The initial ACC view is based on the Appstat database.  Drilling down into the actual ACC retrieves data from the Traffic Summary (trsum) database, which is dependent on logging being enabled on all rules.
  • The Traffic Summary is a rollup of the detailed traffic logs. Matching results could be obtained if all the security rules have been configured to log traffic and session starts and end.

 

Note: Logging is a memory intensive utility.

 

owner: akawimandan



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClglCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language