ACL Hitcount and object-groups

[John Blakley]

I need to get all base ACLs that have a hit count of 0. The problem is that I have object-groups in my acl that get broken down. The problem is that I need the base rule and not 1500 subrules under that. Is there a way that I can get that from the cli? The ASDM allows for it.

access-list INSIDE line 39 extended permit object-group Testports object-group Test-Object object-group GroupA 0x11324546

  access-list INSIDE line 39 extended permit icmp 192.x.x.x 255.255.0.0 host 6.6.6.6 (hitcnt=0) 0xa61ef158

  access-list INSIDE line 39 extended permit icmp 192.x.x.x 255.255.0.0 host 5.5.5.5 (hitcnt=0) 0xf75794aa

  access-list INSIDE line 39 extended permit icmp 192.x.x.x 255.255.0.0 host 4.4.4.4 (hitcnt=0) 0x73e6b2e7

I need only the first line, and only the first line if any of the subentries have a hitcount of 0. Any ideas?

Thanks!

John

[Maykol Rojas]

I dont think I understand your problem... what is it that you need to do? Erase entries on the ACL that has object groups? If that is the case, you may need to erase the network/host inside of the Object so the line gets erased.

Mike

[JohnTylerPearce]

I think what he's wanting to do is get a hitcount from an object-group and not a hit count from the individual network-objects within an object group?