cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1059
Views
0
Helpful
8
Replies
Scott_22
Beginner

Hit Count Analyzer - FMC 6.6.1

When I run the hitcount analyzer for an ACP and export it to a CSV, the rules with 0 hit counts do not have a date indicating they were never used. Is this the expected behavior? For some of the rules with 0, I imagine they were used at some point, but I can't tell with the date missing from the result. 

1 ACCEPTED SOLUTION

Accepted Solutions
Marvin Rhoads
Hall of Fame Guru

Hit counts will increment independent of logging being set. Logging will additionally generate a syslog message.

Hit counts are not retained across a reboot so a zero count is implicitly "since last boot" (or manual clear of the counts).

Reference (from ASA but the same logic applies): https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html#wp3307265190

 

log [[level ] [interval secs ] | disable | default ]

(Optional) Sets logging options when an ACE matches a packet for network access (an ACL applied with the access-group command). If you enter the log keyword without any arguments, you enable system log message 106100 at the default level (6) and for the default interval (300 seconds). If you do not enter the log keyword, then the default system log message 106023 is generated for denied packets. Log options are:

  • level —A severity level between 0 and 7. The default is 6 (informational). If you change this level for an active ACE, the new level applies to new connections; existing connections continue to be logged at the previous level.

  • interval secs —The time interval in seconds between syslog messages, from 1 to 600. The default is 300. This value is also used as the timeout value for deleting an inactive flow from the cache used to collect drop statistics.

  • disable —Disables all ACE logging.

  • default —Enables logging to message 106023. This setting is the same as not including the log option.

View solution in original post

8 REPLIES 8
balaji.bandi
VIP Expert

have you enabled the Log for that ACP, If so please check with the command?image.png

 

You can also test from FTD :

 

show access-control-config

 



BB


*** Rate All Helpful Responses ***

Yes, logging is enabled at the end of the connection. 

Can you post the output from command level and GUI to see what is wrong?



BB


*** Rate All Helpful Responses ***

What output are you looking for? When I run the hit count analyzer, there is not an entry in the "last hit time" field for hit counts of 0. The same is true from the CLI. 

Also to note, I have found rules with an incremented hitaount that do not have logging enabled. Are you sure enabling logging pertains to the hit count analyzer?

Marvin Rhoads
Hall of Fame Guru

Hit counts will increment independent of logging being set. Logging will additionally generate a syslog message.

Hit counts are not retained across a reboot so a zero count is implicitly "since last boot" (or manual clear of the counts).

Reference (from ASA but the same logic applies): https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html#wp3307265190

 

log [[level ] [interval secs ] | disable | default ]

(Optional) Sets logging options when an ACE matches a packet for network access (an ACL applied with the access-group command). If you enter the log keyword without any arguments, you enable system log message 106100 at the default level (6) and for the default interval (300 seconds). If you do not enter the log keyword, then the default system log message 106023 is generated for denied packets. Log options are:

  • level —A severity level between 0 and 7. The default is 6 (informational). If you change this level for an active ACE, the new level applies to new connections; existing connections continue to be logged at the previous level.

  • interval secs —The time interval in seconds between syslog messages, from 1 to 600. The default is 300. This value is also used as the timeout value for deleting an inactive flow from the cache used to collect drop statistics.

  • disable —Disables all ACE logging.

  • default —Enables logging to message 106023. This setting is the same as not including the log option.

View solution in original post

Thank you for clarifying! The previous comment was misleading around how logging should be enabled.

Apologies - i may have mixed things here, Logging is different and hit count is different.

Hit count based on the ACP policies matched and processed.

 

@Marvin Rhoads  is right and corrected.

 



BB


*** Rate All Helpful Responses ***

Content for Community-Ad