how can I get entire session table?

[nextgenhappines]

Working on the 5060 in 5.0.7, the active session count is around 60k+, in cli 'show session all' output will only return ~3000 sessions.   API returns 9995 lines.  How can I get the entire session table?

The use case,  I will like to be able to take a snapshot of the firewall session table at a given specific moment; find out which vsys has the most active sessions, group by top 10 source / destination ip address / destination port per vsys.

Any suggestions?

Thanks,

Ernest

[panos]

Can the Whole Session Log be Exported?

I think taking this report for the sessions after logged (from traffic logs )will give you parallel information.

[workarounds]

Here are the problem that I can see using the traffic logs,

traffic log is only generated when the session is closed/ended, unless you change policy setting to log at session start.  But it is not recommended, and you can't change all the policy at the same time...

How can I do it?

Ernest

[panos]

Hi,

start session is used especially for debugging.you can cofigure this for all policy at one time if you don't have any configured.

Just edit your config with a tool(even word can do)

change

<log-start>no</log-start>
<log-end>yes</log-end>

to

<log-start>yes</log-start>
<log-end>yes</log-end>

Then after you examine what you need for a day or 1 week, you will rollback to old config.

[workarounds]

Hello,

I am looking from an operational perspective, if the firewall session table count is higher than normal, how do you find out which vsys/protocol/source ip/destination ip/destination ports is causing the high session counts? 

E