The difference between the values ​​shown in ACC and Live Session is too large.

[Y.Choi597679]

Hi

I recently discovered something strange while checking a customer's firewall.

The customer firewall's session count typically has a count around 1.5 million.

But the firewall ACC shows a figure of 4 million

I know that ACC is not a real live count and therefore does not completely match the value shown in the CLI or Dashboard.

But this has too large a margin of error

The session tabs for ACC's Source IP Activity and Destination Activity and Rule Usage each show 4 million.

If anyone has experienced something similar or knows of a similar bug, please respond.

[aleksandar.astardzhiev]

Hi @Y.Choi597679 ,

ACC tab will provide summarizade information for the timeframe defined on the top left

While the Session Table view will show you the existing sessions that are currently passing through the firewall.

Even if you decrease the time window for the ACC tab it still will show aggregrated/summarized information. So it is very likely that at this moment you have 1million conccurent sessions, but for the last 30mins they were 4milion

[Y.Choi597679]

thank you for your reply

I understand what you mean.

However, the customer uses snmp to receive session counts from the firewall.

And when you compare the 24-hour session count data of acc and snmp, they do not match at all.

snmp does not exceed 2 million counts in 24 hours
However, I cannot understand the fact that acc shows a figure of 4 million.

I don't think this is correct logic.

Please let me know if there is any wrong logic in what I think