HIT Counts R80.40

[Malik1]

Hi Experts, 

I have a client who wants to remove unused rules , one way of doing it is by identify rules with zero hits. Here I have a query.

1. lets say I have set the hit count for 3 months. that means SMS will store the hit count data for 3 months for each rule in the policy. If I had hits on a specific rule in Jan and for the next 3 months that rule was unused. does the hit count reset to zero? 

2. is there any other way to identify/ delete unused rule. ?

Regards,

SM

[Chris_Atkinson]

Log analysis is another way depending on your tooling.

Refer also:

https://sc1.checkpoint.com/documents/r80.40/webadminguides/en/cp_r80.40_securitymanagement_adminguid...

[G_W_Albrecht]

• Connect to command line on Security Gateway / each cluster member.

• Log in to Clish / Expert mode.

• Run the cpstat blades command.

[Duane_Toler]

I did this for a customer, and used the API command on the management server:

FROM_DATE=$(date -d "90 days ago" +"%Y-%m-%d")

TO_DATE=$(date +"%Y-%m-%d")

JSON_FILE="firewall_rules.last_90_days.json"

CSV_FILE="firewall_rules.last_90_days.csv"

export MGMT_CLI_FORMAT=json



TOTAL_RULES=$(mgmt_cli -r true show-access-rulebase name Network package Standard limit 1 details-level uid | jq '.total')

mgmt_cli -r true show-access-rulebase name Network package Standard show-hits true hits-settings.from-date ${FROM_DATE} hits-settings.to-date ${TO_DATE} use-object-dictionary true limit ${TOTAL_RULES}  > ${JSON_FILE}



echo '"Rule Number","Source","Destination","VPN","Service","Rule Action","Install On"' |tee ${CSV_FILE}



for rule in $(jq -r '.rulebase[] |

  select(.type=="access-rule"), select(.type=="access-section").rulebase[] |

  select(.enabled) |

  select(.hits.value == 0)."rule-number"|@text' ${JSON_FILE})

do



jq --arg rule $rule '( [ ."objects-dictionary"[] | { key:.uid, value:.name  } ] | from_entries ) as $objs |

  .rulebase[]| select(.type=="access-rule"),select(.type=="access-section").rulebase[] |

  select((."rule-number"|@text)==$rule) |

   [ ( [ ."rule-number"|@text ]|@csv ),

     ( [ $objs[."source"[]] ]|@csv),

     ( [$objs[."destination"[]] ]|@csv),

     ( [ $objs[."vpn"[]] ]|@csv ),

     ( [ $objs[."service"[]] ]|@csv ),

     ( [ $objs[."action"] ]|@csv ),

     ( [ $objs[."install-on"[] ] ]|@csv )

   ] |@csv

' < ${JSON_FILE}

done |\

sed -e 's@\\"\\"@@g' -e 's@\\"@"@g' -e 's/^""/"/g' -e 's/""$/"/g' |tee -a ${CSV_FILE}

echo

The CSV file has a list of the rules with zero hits.  Use however you wish.  Adjust numbers in the script however you want.

# cat firewall_rules.last_90_days.csv

"number","source","destination","vpn","service","action","install on"

"1","obj1,obj2","obj1,obj2","Any","Any","Accept","gateway"

"28","obj3","obj4","Any","http","Accept","gateway2"

[Malik1]

Hi Duane, 

im new to API , i did a copy/paste of the syntax shared on the smart console command cli  and every time it gets crashed.

Can I run this via expert mode. is there any syntax that I have to add.

Please guide.

[G_W_Albrecht]

This is a .sh script that should run in expert mode - you have to rename the policy package to your policy package name...

[Malik1]

Hello, 

Can u help me or guide how to run such scripts 

[PhoneBoy]

It is generally expected that, when using expert mode (including for running scripts), that the administrator has some basic Linux/Unix knowledge.

Versus copy/pasting a script, you might try a pre-built script that largely accomplishes the same thing: https://community.checkpoint.com/t5/API-CLI-Discussion/Disable-Delete-Rules-with-a-Zero-Hit-Count-MD...
After downloading the script to the management station, use chmod 755 to make the script executable (e.g. chmod 755 cleanup-zero-hits.sh).

[PhoneBoy]

Scripts like that won’t work in the SmartConsole CLI, it has to be done in expert mode.

[G_W_Albrecht]

Tried cpstat blades yet ?

[Malik1]

This gives the rules with top hits . what I need is the rules with zero hits.

[G_W_Albrecht]

Find some possibilities to see it here: sk85780: How to use the 'connstat' utility

[Malik1]

unfortunately this is only for Windows OS,