The difference between the values ​​shown in ACC and Live Session is too large.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

The difference between the values ​​shown in ACC and Live Session is too large.

L1 Bithead

Hi

 

I recently discovered something strange while checking a customer's firewall.

The customer firewall's session count typically has a count around 1.5 million.

 

But the firewall ACC shows a figure of 4 million

I know that ACC is not a real live count and therefore does not completely match the value shown in the CLI or Dashboard.

But this has too large a margin of error

The session tabs for ACC's Source IP Activity and Destination Activity and Rule Usage each show 4 million.

 

If anyone has experienced something similar or knows of a similar bug, please respond.

 

 

 

 

 

 

 

 

 

2 REPLIES 2

Hi @Y.Choi597679 ,

 

ACC tab will provide summarizade information for the timeframe defined on the top left

aleksandarastardzhiev_0-1731078899806.png

While the Session Table view will show you the existing sessions that are currently passing through the firewall.

Even if you decrease the time window for the ACC tab it still will show aggregrated/summarized information. So it is very likely that at this moment you have 1million conccurent sessions, but for the last 30mins they were 4milion

thank you for your reply

I understand what you mean.

However, the customer uses snmp to receive session counts from the firewall.

And when you compare the 24-hour session count data of acc and snmp, they do not match at all.

snmp does not exceed 2 million counts in 24 hours
However, I cannot understand the fact that acc shows a figure of 4 million.

I don't think this is correct logic.

 

Please let me know if there is any wrong logic in what I think

 

 

  • 325 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!