Security Policy > CSV missing Hitcount

[ahutchison]

I am performing an audit of our 0 hit count rules and verifying if they are needed. I had begun the audit prior to upgrading the the latest jumbo hotfix take 139 on our R81.10 gateways. After the upgrade I continued my audit and discovered that my hit count column produced by the smart console export is now blank, showing no data in the column.

[the_rock]

Weird, I did same in R81.20 jumbo 54 and exact same problem, I dont see anything in hits column. @PhoneBoy , is this normal?

Andy

[the_rock]

Check this out @ahutchison ...I just exported lab rules on eve-ng mgmt server, same exact version as Azure, R81.20 jumbo 54 and this one shows hits just fine. Now, Im really confused...

Andy

[Lesley]

are you running latest SmartConsole build? 

https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10_SC/R81.10/R81.10_Downloads.htm?tocpath=_____2

[the_rock]

I dont believe that would be an issue, cause in my lab where this worked, Im not using latest console build, but it is latest in lab where it does not work.

Andy

[ahutchison]

running R81.10

[the_rock]

I dont have R81.10 to test, but Im sure it would be same behavior like yours.

Andy

[m1l0514v]

FYI

The same situation - missing hit counts in policy .csv export - for R81.10 T150 and SmartConsole 81.10.9600.426 . 😞

In the meantime (from April 2024), @ahutchison, haven't you find any workaround? Thanks

milo

[the_rock]

Just tested in R81.10 lab mgmt (latest jumbo, 165), worked fine, I can see the hits when I export the rules.

Andy

[the_rock]

Created another lab mgmt, latest R81.10 version and hit count is broken...very inconsistent.

Andy

[m1l0514v]

@the_rock, thank you for your effort and info.

I am going to take a closer look at the topic in next days.My primary intent is to get list of 0 hits' rules and disable/delete them.

Probably I will try 6 year old @Adam_Forester 's script - https://github.com/cpmidsouth/Delete-or-Disable-Zero-Hit-Rules or any other solution using API.

milo

[the_rock]

No problem! Hope it helps.

Andy

[PhoneBoy]

The script should still work as the API hasn't changed that much 🙂
(And if he "versioned" his API calls, then it definitely will work)