Recent Hitcount, but no log entry

[Martijn]

Hi All,

We are cleaning up a rule base and investigate which rules are used and which one are not.
We use Hitcount and SmartLog to see which rules aren't used and can be deleted.
We are seeing something strange and maybe one of you can explain this.

When we look at the Hitcount of a rule, we can see a Last hit today at 9:50 for example.
But when we check SmartLog for this rule (selecting the rule and check at the bottom), there are nog log entries.
We are seeing several rules with this. No logs, but a recent Last hit in Hitcount.

All rules are logged and we are on R81.20 Take 26 for the management server. SmartConsole is R81.20 649.

Anyone seen this before and can explain what may be going on?

Thanks,
Martijn

[Henrik_Noerr1]

Hey Martijn,

I cannot say if we have seen your issue - but we do see it regularly the other way around, where the hit counter is not updated, but we do see the logs in SmartLog.

Keep that in mind when deleting rules.

/Henrik

[the_rock]

I had seen it in R81.10, but never in R81.20.

Andy

[Martijn]

Andy,

Not all gateways are on R81.20 yet, so maybe it is a gateway issue and not a SmartCenter issue.

Martijn

[the_rock]

Makes sense, agree.

Andy

[the_rock]

I should also add as well, from my experience, this MOSTLY seems to happen in S1C environment, I thoink I seen it only once as far as on prem mgmt, but again, as you indicated, its entirely possiblt it could be gateway side, not the mgmt.

Best,

Andy

[Amir_Senn]

What kind of log is it? Could be it's a log update?

For example, Application Control session remains open for 3 hours and updates comes for active session every 10 minutes if I remember correctly.