Unable to clear Apps seen from local firewall

Reply
Highlighted
L2 Linker

Unable to clear Apps seen from local firewall

Hello,

Has anyone seen the following issue? 

Panorama manages a security policy for a remote PA, if you try clear the app seen counter on the remote PA using this KB https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/security-policy-rule-optimization/p... you get a server error: fail to clear usage data error.

 

If I clear the apps seen usage on the Panorama cli for the rule in question, I see the value back to 0, but on the remote PA it still shows the old usage count. Any reason why?

Tags (1)
Highlighted
L7 Applicator

Re: Unable to clear Apps seen from local firewall

The reset only happens on the panorama locally, ifnyounwant to reset the firewall also, you need to clear the counters there also

reaper - PANgurus.com
I drink and I know things
Highlighted
L1 Bithead

Re: Unable to clear Apps seen from local firewall

Where do i go to clear the counters on the FW, specific to apps seen? 

Highlighted
L2 Linker

Re: Unable to clear Apps seen from local firewall

for local rules you can clear app's seen using this link

 

for rules manage by panorama, you will need to clear them on on Panorama, but It does not appear to sync to the remote firewall.

Highlighted
L4 Transporter

Re: Unable to clear Apps seen from local firewall

If you have a large number of rules, and want to save a lot of time over copying them individually in the GUI, it can be useful to export the list of rules from Panorma as a CSV and include the rule UUID column.  You can then use a text editor like Notepad++ to prepend clear policy-app-usage-data ruleuuid to each entry, and paste the whole thing into your firewall's CLI.  You'll want to run this command before pasting:

set cli scripting-mode on

 

Highlighted
L1 Bithead

Re: Unable to clear Apps seen from local firewall

Thanks, that is what the OP tried. It only works when using Panorama. I want to clear the counter for apps seen on the local FW. Reaper's reply was to clear counters, that is what I'm looking for. You would think the command should work on the local FW, but it doesn't.

 

admin@palo220> clear policy-app-usage-data ruleuuid 66d7cf61-465c-4b47-bcc4-19b302919827

Server error : Failed to clear usage data
admin@palo220>

 

Highlighted
L2 Linker

Re: Unable to clear Apps seen from local firewall

Same issue I ran into, if the policies are push from panorama to the firewall, you can't clear the Apps seen counter on the PA. Not sure if this is a bug or by design, If you convert the policy to a local rule on the firewall you can run the command just fine.

Highlighted
L4 Transporter

Re: Unable to clear Apps seen from local firewall

In my experience, policy optimizer is incredibly buggy, and the data isn't completely trustworthy.  This seems to be one of those bugs.  I was looking back on some internal notes from when I ran into this a few months ago.  I found something else that makes this even more odd.  When you run the clear policy-app-usage-data ruleuuid command in the firewall CLI, you get the error message, and the total apps displayed in the Apps Seen column doesn't change.  However, the detailed list of apps does seem to get flushed.  It's deceiving, but if you're trying to see which apps have hit the rule since it was last cleared, it still might be somewhat useful.  It's frustrating though.

Before:

Before clearing usage dataBefore clearing usage data

 

After:

After clearing usage dataAfter clearing usage data

Highlighted
L1 Bithead

Re: Unable to clear Apps seen from local firewall

I don't have a Panorama in my environment. This is a standalone 220 in my lab.

Highlighted
L1 Bithead

Re: Unable to clear Apps seen from local firewall

Thanks OwenFuller, you are correct. This does help!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!