User Count

[Maarten_Sjouw]

I'm looking for a way to see how many unique IP's have been passing through the FW during a day. Is there anyone who can tell me how to get this, If I need to run a script that just mails me the total per day every day, that is fine with me, it is just that I do not have a clue how and where to start.

Running R80.10 ATM and no IA in use. We will soon be moving to R80.20 and IA will be enabled also, but this can take another 3-6 months.

[Danny · Accepted solution]

I would check if it's possible to get that info from cpstat or cpinfo. If that's not of help I would probably just do a logrotate at midnight, dump the content to text, delete everything except the IPs, sort, uniq, wc -l and email the returned number to my  inbox.

[G_W_Albrecht]

According to sk10200: 'too many internal hosts' error in /var/log/messages on Security Gateway, the Security Gateway listens for any IP-based traffic on all interfaces except for the one deemed "external", which is decided by the user and listed in $FWDIR/conf/external.if file. Anytime a host is "heard" talking on a non-external interface, Security Gateway logs this information in $FWDIR/database/fwd.h file and in $FWDIR/database/fwd.hosts file on the Security Gateway.

[Maarten_Sjouw]

Sorry Günther W. Albrecht, I checked but it seems that in a unlimited license environment these files do not exist.

Thanks https://community.checkpoint.com/people/917b8439-9d5c-34f0-b86a-f0e1b0a14cbd  we were able to use this and find the number, now I just need to make sure we collect all the correct information, to make sure that when a logfile crosses the 2GB limit, we collect all information of each day.

But we are on the right path.

[Danny]

I'm glad I could be of help.

[Maarten_Sjouw]

This is what we ended up doing:

cd $FWDIR/log
fwm logexport -np -i log/2019-01-17_000000.log -o 2019-01-17_000000.exp
cat 2019-01-16_000000.exp | grep accept | cut -d ';' -f20 | sort | uniq | grep '^10.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$' > ip-list

wc -l ip-list > count

[Danny]

Thanks for posting the final solution.

[JozkoMrkvicka]

Valid under the assumption that all firewall rules are logged.

[Maarten_Sjouw]

Polished it a bit and put it in a bash script with the added point that you can add the logfile name on the command line:

LF=$1
   if [ "$LF" == "" ]; then
   LF="fw.log"
fi
fwm logexport -np -i $LF | grep accept | cut -d ';' -f20 | sort | uniq | grep '^10.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$' > IP-list
wc -l IP-list > count
echo
echo
echo "For logfile $LF the number of unique IPs is:"
cat count

[G_W_Albrecht]

This seems appropriate as all these files are used for is User IP counting for checking the license limits. Unlimited licenses do not need that, of course, but you did not mention that in your initial post at all...

[Maarten_Sjouw]

I thought that user based licenses were a thing of the past since the blade licenses? It's a long time ago that I have seen licenses with a user limit, where it also was enforced.

[G_W_Albrecht]

No, we still have user based licenses (e.g. EPS clients) and seat based licenses (e.g. MAB, only the number of concurrent users is limited). Also see Remote Access Users license + count.