Bandwidth utilization report based on source or destination

[Mahipal_Singh]

Hi Expert,

One of my customer is trying to generate the report of bandwidth utilization based on Source, Destination and for that they have to enable accounting for the required rules. Now if they enable the account the accounting logs in each rule then how much load be increased on gateway and management/log server. They have separate dedicated log & Event server and currently have 10GB logs per day from 3 clusters. How much CPU, Memory and Storage needs to be increase on Mgmt & log server? They have mix of 13500/13800, 23900 & 41K/44K clusters and those are 20%-30% utilized in peak load.

[Timothy_Hall]

If you were to enable Accounting for all rules in the policy, expect roughly a doubling of log events being sent to the SMS/log server by the gateway(s).  In addition to the standard logging at the start of the connection, use of Accounting adds an extra consolidated log event when the connection ends, or every 10 minutes if the connection lasts that long.

[PhoneBoy]

I don't believe this will increase the usage of any of the above substantially as accounting data is largely tracked by SecureXL.

[Timothy_Hall]

Right using Accounting does not affect the eligibility for accelerating traffic on the gateway, but my take on the question was that it was more about the logging load increase on the SMS/log server.

[Mahipal_Singh]

Thanks for your inputs, one last query - does it impact log server storage, if yes how much storage do we need to increase (if customer have 10GB logs per day without smart event.)

[Tomer_Noy · Accepted solution]

Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.

If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.

Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.

[Tomer_Noy]

BTW, if you're using R80.10 and above, you can do something really nice with layers.

If you create an ordered layer and place it at the end (bottom), then all traffic that passes the previous layers will go through it as well. In order to be accepted, traffic must be accepted by all layers, so put a cleanup rule for Any-Any-Accept, Track=None. This will ensure that the layer doesn't change the traffic handling.

Now you can add rules above the cleanup for the specific traffic you want to log with accounting. For example: Source=my_network, Destination=dest_network,Accept, Track=Log+Accounting.

Any traffic between that source and destination will add accounting information to the logs. This way you don't need to "hunt down" the relevant rules in your big policy. Also, if you only need accounting on some sub network (that is smaller than the scope of the rule), then this way the accounting will be added more granularly.

You can also use this method to add Detailed or Extended logging on certain traffic. You can even add Alerts on certain suspicious traffic that you aren't sure you want to block.