Working on the 5060 in 5.0.7, the active session count is around 60k+, in cli 'show session all' output will only return ~3000 sessions. API returns 9995 lines. How can I get the entire session table?
The use case, I will like to be able to take a snapshot of the firewall session table at a given specific moment; find out which vsys has the most active sessions, group by top 10 source / destination ip address / destination port per vsys.
start session is used especially for debugging.you can cofigure this for all policy at one time if you don't have any configured.
Just edit your config with a tool(even word can do)
Then after you examine what you need for a day or 1 week, you will rollback to old config.
You could always use the "count yes" syntax of the CLI command show session all
By adding progressively more specific filters, you can narrow down the sessions you are looking for. For example:
> show session all filter count yes
> show session all filter count yes from trust
> show session all filter count yes from trust application web-browsing
> show session all filter count yes from trust application web-browsing source 192.0.2.5
... and so on. By getting the count for each filter, you can find what may be odd in favor of what you are looking for. With the filter, you may not be able to display more than 3000 entries or whatever is present, but the count should help narrow down what is causing the imbalance.
Hope this helps,
Right, I can use show session meter to determine which vsys has the high session counts and start drill down from that point. But some vsys has 15k+ sessions. By drilling down via cli to determine the cause of the high session count, that could take few minutes if lucky, else you may not able to find the problem.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!