Finding unused objects in policies

[JohnT]

Hi,

I'm wondering if there's a way to see when an object last had a hit on it? I know there is for security policies, but I'm wondering about specific objects.

We don't have Panarama, and I'm just thinking about creating a new syslog server to capture historical data(going forward) to find these unused objects. I'm hoping that there's some kind of cli that may show this information.

any thoughts thanks

John

[jdelio]

You are wanting to know not only what rule was used, but more specifically when a certain object was used in that rule?

[BPry]

@JohnT,

There's nothing that I'm aware readily available to do anything like this on the firewall. You can always attempt to simply delete the object in question (or all/any object), the firewall will present an error message for any object still referenced in the configuration and prevent you from removing it. 

[JohnT]

I can find what rules an object belongs to, what I'm looking for is when was an object last hit. For example, I have object 11.11.11.11 used in a policy, when did it get hit in the policy last 1 hour ago or 2 years ago. thanks John