I want to find maxmimum session count reached in the past month. Now the PA device is not live, so i cannot find the current/live session count from the dashboard.
Under monitor > App Scope > network monitor i can get the traffice detail for the session count but it is showing number session for the whole day. I have attached the screenshot of the same for your reference.
And also created a report for number of session in any any allow rule(in virutal wire deployment), but report is generated for the whole 15 minutes(not less time than 15min), wecant find the peak value.
Can someone help me to get Maximum session count reached for the past month or any specific time.
then either tab or ?
you should see older files also (like dp-monitor.log.2 and dp-monitor.log.3)
and then change command accordingly
grep dp-log dp-monitor.log.2 pattern "Number of active sessions"
if you use command
less dp-log dp-monitor.log
then you see full file.
type command below to see timestamps when session counts were taken
grep dp-log dp-monitor.log.2 pattern "panio"
You can do "repeat count" from the traffic log and generate a report with resolution of 15 minutes slots (which seems to be the lowest?) as described in https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-g... (this particular link is about the same topic but limited to SSL - in your case just remove "appid:ssl" from your report and you should get the total amount of sessions per timeslot).
Note however that I think this is number of ENDED sessions during this timeslot, not necessary number of concurrent sessions.
I guess you would need to file this as a feature request that the AAC and report engine should log number of concurrent sessions (per appid or so) and add resolution of lets say once a minute to get a more detailed "performance graph" when it comes to concurrent sessions.
Another workaround might be if the current session count can be readout through SNMP (or in worst case through RESTAPI) and then in realtime graph this - but the thing is that you shouldnt have to rely on external components, the AAC should be able to do this on its own.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!