max session count in a month

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

max session count in a month

L4 Transporter

Hi All,

          I want to find maxmimum session count reached in the past month. Now the PA device is not live, so i cannot find the current/live session count from the dashboard.

 

Under monitor > App Scope > network monitor i can get the traffice detail for the session count but it is showing number session for the whole day. I have attached the screenshot of the same for your reference.

 

session count for 30days.jpg

 

And also created a report for number of session in any any allow rule(in virutal wire deployment), but report is generated for the whole 15 minutes(not less time than 15min), wecant find the peak value.

 

Can someone help me to get Maximum session count reached for the past month or any specific time.

 

 

with regards,

Ram.

4 REPLIES 4

Cyber Elite
Cyber Elite

From cli:

grep dp-log dp-monitor.log pattern "Number of active sessions"

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi Raido,

               Now the device is not in production/live, so active session details are not shown. I ran the commands and all the results were showing 0.

 

Can you give some command to find active sessions on the particular time period.

 

 

 

with regards,

Ram

less dp-log

then either tab or ?

you should see older files also (like dp-monitor.log.2 and dp-monitor.log.3)

 

and then change command accordingly

grep dp-log dp-monitor.log.2 pattern "Number of active sessions"

 

if you use command

less dp-log dp-monitor.log

then you see full file.

type command below to see timestamps when session counts were taken

grep dp-log dp-monitor.log.2 pattern "panio"

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L6 Presenter

You can do "repeat count" from the traffic log and generate a report with resolution of 15 minutes slots (which seems to be the lowest?) as described in https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-g... (this particular link is about the same topic but limited to SSL - in your case just remove "appid:ssl" from your report and you should get the total amount of sessions per timeslot).

 

Note however that I think this is number of ENDED sessions during this timeslot, not necessary number of concurrent sessions.

 

I guess you would need to file this as a feature request that the AAC and report engine should log number of concurrent sessions (per appid or so) and add resolution of lets say once a minute to get a more detailed "performance graph" when it comes to concurrent sessions.

 

Another workaround might be if the current session count can be readout through SNMP (or in worst case through RESTAPI) and then in realtime graph this - but the thing is that you shouldnt have to rely on external components, the AAC should be able to do this on its own.

  • 8354 Views
  • 4 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!