Unable to clear Apps seen from local firewall

[sami-su]

Hello,

Has anyone seen the following issue? 

Panorama manages a security policy for a remote PA, if you try clear the app seen counter on the remote PA using this KB https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/security-policy-rule-optimization/p... you get a server error: fail to clear usage data error.

If I clear the apps seen usage on the Panorama cli for the rule in question, I see the value back to 0, but on the remote PA it still shows the old usage count. Any reason why?

[reaper]

The reset only happens on the panorama locally, ifnyounwant to reset the firewall also, you need to clear the counters there also

[abstractclass]

Where do i go to clear the counters on the FW, specific to apps seen? 

[sami-su]

for local rules you can clear app's seen using this link

for rules manage by panorama, you will need to clear them on on Panorama, but It does not appear to sync to the remote firewall.

[OwenFuller]

If you have a large number of rules, and want to save a lot of time over copying them individually in the GUI, it can be useful to export the list of rules from Panorma as a CSV and include the rule UUID column.  You can then use a text editor like Notepad++ to prepend clear policy-app-usage-data ruleuuid to each entry, and paste the whole thing into your firewall's CLI.  You'll want to run this command before pasting:

set cli scripting-mode on

[abstractclass]

Thanks, that is what the OP tried. It only works when using Panorama. I want to clear the counter for apps seen on the local FW. Reaper's reply was to clear counters, that is what I'm looking for. You would think the command should work on the local FW, but it doesn't. 😕

admin@palo220> clear policy-app-usage-data ruleuuid 66d7cf61-465c-4b47-bcc4-19b302919827

Server error : Failed to clear usage data
admin@palo220>

[sami-su]

Same issue I ran into, if the policies are push from panorama to the firewall, you can't clear the Apps seen counter on the PA. Not sure if this is a bug or by design, If you convert the policy to a local rule on the firewall you can run the command just fine.

[OwenFuller]

In my experience, policy optimizer is incredibly buggy, and the data isn't completely trustworthy.  This seems to be one of those bugs.  I was looking back on some internal notes from when I ran into this a few months ago.  I found something else that makes this even more odd.  When you run the clear policy-app-usage-data ruleuuid command in the firewall CLI, you get the error message, and the total apps displayed in the Apps Seen column doesn't change.  However, the detailed list of apps does seem to get flushed.  It's deceiving, but if you're trying to see which apps have hit the rule since it was last cleared, it still might be somewhat useful.  It's frustrating though.

Before:

Before clearing usage data

After:

After clearing usage data

[abstractclass]

I don't have a Panorama in my environment. This is a standalone 220 in my lab. 🙂

[abstractclass]

Thanks OwenFuller, you are correct. This does help!