What the different between 'count' and 'repeat count' in the report?

[Kanitin]

Hi everyone,

I need to know the diffrent between 'count' and 'repeat count' in the report. I found the description of 'repeat count' in the Admin Guide only, but can't found 'count'.

 - Repeat Count (repeatcnt): Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds; used for ICMP only

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/syslog-field-des...

Does anyone have any details of this?

Best regards,

[reaper · Accepted solution]

Hi!

correct me if i'm wrong, but i think you're mixing the log field format with the available collumns in the reports

'count' is used in reports to count how many times a contextual object is seen in the timeframe of the report

while 'repeat count' is a log field that indicates only 1 log was written for X repeats of identical ICMP sessions in 5 seconds

[mikand · Accepted solution]

As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace).

Count is the number of log entries (rows) you have located.