Set specific timestamp to determine hit count for all firewall rule in the SMS & Reset hitcount

[Kid555]

Hi All,

I am checking if I can set specific timestamp to determine the hit count for all firewall rules in the SMS.

Tried looking around for SK but wasn't able to find one.

And can I confirm the below KB to reset the hit count for a specific rule/all rules?

How to reset Hit Count for a specific rule: SK111832

How to reset the Hit Count in R80.x: SK111162

[_Val_]

The question is not clear, could you please elaborate? What are you trying to do?

[Kid555]

for the first inquiry, "Set specific timestamp to determine hit count for all firewall rule"

I want to check if there is a way for me to view/set the timestamp on every hitcount on all my firewall rules

[_Val_]

Once again, could you please elaborate, all rules in the policy package reset to 0, or just one/some of the rules

[Kid555]

Hi Val, Apologies for the confusion. 

Instead, can I enquire about this,

"Set specific timestamp to determine hit count for all firewall rules"

I want to check if there is a way for me to view/set the timestamp on every hit count on all my firewall rules?

[_Val_]

Depending on your SmartConsole settings, you see the number of hits for up to 3 months. Full info is in the user guide, for example: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

 You can also shorten it to 1 day, 1 week, and 1 month, see the guide. 

With the solutions above, there are ways to reset either all hit DB or specific rules. After the reset, the hit counts will be accumulated according to your indication period, once again, up for three months. It is fair to say that, if you did not modify anything from default, all counters show you the last three-month data from this very point in time.

Hope it answers your question. If not, ask again 

[PhoneBoy · Accepted solution]

This needs to be done through the API.
More precisely, you can query a specific Policy Layer to provide the hit counts since a given time (e.g. show-hits true hits-settings.from-date "2014-01-01")
See: https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-access-rulebase~v1.9%20
I am not aware of a way to accomplish this in SmartConsole and will probably require a script. 

[the_rock]

Hey @Kid555 

As far as first SK you pointed out, procedure is pretty simple and I tested it in my R81.20 lab and worked fine. Does it not work for you? Cause literally all you do is what it says, copy/paste the rule, then delete original rule, push policy, thats it. Also, something else worth pointing out (at least from my experience), I never found hit count to work CONSISTENTLY, until R1.20, where it works flawlessly. So, as long as your mgmt is on R81.20 and gateways at least R81+, even NAT policy rules hit count works as expected, which never worked properly before.

Andy

To reset the Hit Count for specific rule(s), proceed as follows:

1. Open the relevant policy package via SmartConsole.
   
   
2. Copy/paste the rule you want to reset Hit Count for.
   
   
3. Delete the original rule.
   
   
4. Install the Security policy.