CLI command to get the unused/zero hits security policy.

[sandeep.paul]

I see unused check box on GUI, what is the command to get similar results on CLI

[BPry · Accepted solution]

@sandeep.paul

show running rule-use rule-base <option> type unused vsys vsys1

That command will give you, in my opinion, an easier to read list than what the GUI is capable of giving you. 

[sandeep.paul · Accepted solution]

Thanks BPry

[sandeep.paul]

Does tho command show unused policies since last reboot? Is there any duration or how far it checks on the unused policies. Please let me know.

[BPry]

@sandeep.paul,
Correct. That command, and the firewall in general, is only going to be able to tell you if the policy has been used since the device was last restarted. Once you restart all of your rules will become unused until they actually match to another session.

[sandeep.paul]

Thanks, is there any command that we will know if sec policy is not being used from Day it was configured?

[Brandon_Wertz]

---

@sandeep.paul wrote:
Thanks, is there any command that we will know if sec policy is not being used from Day it was configured?

---

Unfortunately no