What the different between 'count' and 'repeat count' in the report?

cancel
Showing results for 
Search instead for 
Did you mean: 

What the different between 'count' and 'repeat count' in the report?

L1 Bithead

Hi everyone,

 

I need to know the diffrent between 'count' and 'repeat count' in the report. I found the description of 'repeat count' in the Admin Guide only, but can't found 'count'.

 

 - Repeat Count (repeatcnt): Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds; used for ICMP only

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/syslog-field-des...

 

Does anyone have any details of this?

 

Best regards,

 

 

2 ACCEPTED SOLUTIONS

Accepted Solutions

Cyber Elite
Cyber Elite

Hi!

 

correct me if i'm wrong, but i think you're mixing the log field format with the available collumns in the reports

 

'count' is used in reports to count how many times a contextual object is seen in the timeframe of the report

while 'repeat count' is a log field that indicates only 1 log was written for X repeats of identical ICMP sessions in 5 seconds

 

2016-09-02_14-49-11.jpg

2016-09-02_14-53-54.jpg

Tom Piens
PANgurus - (co)managed services and consultancy

View solution in original post

As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace).

 

Count is the number of log entries (rows) you have located.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hi!

 

correct me if i'm wrong, but i think you're mixing the log field format with the available collumns in the reports

 

'count' is used in reports to count how many times a contextual object is seen in the timeframe of the report

while 'repeat count' is a log field that indicates only 1 log was written for X repeats of identical ICMP sessions in 5 seconds

 

2016-09-02_14-49-11.jpg

2016-09-02_14-53-54.jpg

Tom Piens
PANgurus - (co)managed services and consultancy

As I (currently 😉 understand it "repeat count" is a single log entry but it informs that the same event occured x number of times within 5 seconds (like lets say you get a DDoS of incoming junk, instead of log each and every session you only log a few entries but inform that this happend x number of times - basically to save mgmtplane resources but mainly logspace).

 

Count is the number of log entries (rows) you have located.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!