Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Jose_Ramon_Rodr
Participant
Jump to solution

Searching zero hits rules in R80.10

Hi,

Prior to R80.10 you could find every rule with zero hits right from the search bar. For instance, in R77.30 you could see only the rules with no hits this way:

Now in R80.10 I can't find the way to do that search. In "Searching a Rule Base" page in SmartConsole R80.10 Help there are no clues about it.

Is there a way to do this search?


Greetings.

(1)
2 Solutions

Accepted Solutions
Tomer_Sole
Mentor
Mentor

Hi,

This is a limitation of R80.10 and R80.20.

We plan to have it back in our next releases.

No need for RFE on a thing that we had before.

The short-term alternative is using the API. But we are aware that isn't ideal.

Thank you for this feedback.

View solution in original post

(1)
Firoj
Explorer

Hii Jose..

Yes in you can search 0 hit rules in R 80.10 & 20 as well. follow the below instruction.

Right click on rule number >> Expand the Hit count tab  >>again expand the time frame >> then select the required time duration ie; 3 month or 1 month. 

Now come on the top tab ie;  source or destination and right click and check the Hits tab. you will be able to see all 0 hits policies.  

 

Thanks.

View solution in original post

32 Replies
PhoneBoy
Admin
Admin

You can script the disabling or deletion of said rules with the API.

See: Disable/Delete Rules with a Zero Hit Count (MDS or SMS)

0 Kudos
Jose_Ramon_Rodr
Participant

Thanks. This can be a very useful script (and a nice starting point to work with advanced CLI commands) but it's not what I need, a way of search visually those rules as it was in previous versions.

PhoneBoy
Admin
Admin

I'm not aware of a way to do it visually with SmartConsole.

I'm guessing it's because there's no way currently to query the rulebase based on hit count in the API.

The API can return the hits associated with a given rule, which is what the script I referred to actually does.

Possible RFE Tomer Sole‌?

Abhishek_Kumar1
Collaborator

Hi -

 

You can enable hit option on top.

then type the disable list in search tab, it will see your all disable rules.

 

Regards

Abhishek

Zeljko
Participant

Hey - how exactly do you do that ?

Zeljko
Participant

hey,
how exactly do you do that ?
kr
Zeljko

0 Kudos
Tomer_Sole
Mentor
Mentor

Hi,

This is a limitation of R80.10 and R80.20.

We plan to have it back in our next releases.

No need for RFE on a thing that we had before.

The short-term alternative is using the API. But we are aware that isn't ideal.

Thank you for this feedback.

(1)
Frank_Faber00
Participant

Hi,

This was 2018! Can you tell me in which version the feature is added? Or will be added?

Thanks,

Frank

 

rloureiro
Explorer
Hi all,

I have two questions:

1. Will this feature be added in future versions?
2. The API only disables/deletes rules with 0 hits or also lists before which it will disable/delete? In my case I just want to list the rules with 0 hits and decide for myself which ones to disable/delete.

Thank you in advance.

Regards.
dj0Nz
Advisor

Any news? Feature seems still not available in R80.30... 😶

Christian_Wagen
Contributor

When is it coming?

0 Kudos
Sulaman_Tapiree
Explorer

any news?

0 Kudos
stallwoodj
Collaborator

Please do bring this back!

🙂

Thanks

Jamie

Will_H
Contributor

In these unprecedented times it would be nice if this worked. 

dj0Nz
Advisor

Just a reminder. Feature still missing in R80.40. 😳

Dima_M
Employee
Employee

Hi all, thanks for heads up, we're working to bring this back to SmartConsole, stay tuned...

But rulebase analysis and cleanup can be done today. we have awesome tool called PolicyCleanUp  which allows automatic cleanup of your policy based on hits count.

The tool runs on a policy and a domain that you named. If a rule was not hit for the number of days that you configured, the rule is a candidate to be disabled.
If a rule is disabled for the number of days that you configured, the rule is a candidate to be deleted.
You can adjust the code according to your organization’s policy / needs. This tool can be executed on Management Server / Multi-Domain servers of version of R80.10 and up.

S_E_
Advisor

Hi,

searching/sorting hit counters is also interesting while troubleshooting, not only for deleting cleanup rules. Not sure why there is always a need to install/add scripts to bring back several features from R77 back to R80.  (e.g. clone admin account;revision control; workflow)

b.t.w. the feature is also not visible in R81 public EA

Best Regards

 

 

Jim_Fessler
Contributor

While you may think the tool is awesome I have never worked anywhere where policy could be deleted without review usually by a second party. After two years adding it must be a very low priority. 

ssaglauskas
Explorer

Hi, Any news? Feature seems still not available in R80.40...

0 Kudos
PhoneBoy
Admin
Admin

It's not available in R81...or R81.10 either from what I can tell.

0 Kudos
Frank_Faber00
Participant

Dear Check Point,

3 years have gone by and several versions later still no sign of the return of the Zero Hits function. Should we request a RFE after all to get it done? Or is any progress to report?

 

PhoneBoy
Admin
Admin

I recommend engaging your local office with this requirement.

Timothy_Hall
Champion
Champion

Is this a veiled reference to the Check Point Solutions Center Dameon?

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
PhoneBoy
Admin
Admin

That's ultimately where the request will end up, yes.
However, customers can't engage with Solution Center directly, thus going through the local Check Point office. 

0 Kudos
James_Frederick
Explorer

4 years later still no 0 hit search function... =(

0 Kudos
Manuel_Graft
Explorer

It will be very useful if the new release will also include this view in the Export (csv) report.

CP_Hit.png

Firoj
Explorer

Hii Jose..

Yes in you can search 0 hit rules in R 80.10 & 20 as well. follow the below instruction.

Right click on rule number >> Expand the Hit count tab  >>again expand the time frame >> then select the required time duration ie; 3 month or 1 month. 

Now come on the top tab ie;  source or destination and right click and check the Hits tab. you will be able to see all 0 hits policies.  

 

Thanks.

Zeljko
Participant

Hello,

I'm not sure why you report this as solution, this still doesn't work in R80.40 ..
If it does, pls explain in more detail, maybe with a screenshot how you are doing that. I can't verify what you mean with "the top tab ie;  source or destination and right click and check the Hits tab"

thx, kr
Zeljko

Martin_Raska
Advisor
Advisor

I dont understand it either.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events