Hit count indicates the number of times a policy rule or default action has been matched to a connection. The hit count is incremented only for the first packet of a connection that matches a rule. You can use this information to identify the efficacy of your rules. Hit count information is available only for access control and prefilter rules applied to threat
defense devices.
Note |
-
The count persists through reboots and upgrades.
-
Counts are maintained by each unit in an HA pair or cluster
separately.
-
You will not be able to derive the hit count information from a device when deployment or a task is in progress on the device.
-
You can also see rule hit count information in the device CLI using the show rule hits command.
-
If you have accessed the Hit Count page from the Access Control Policy page, you will not be able to view or edit prefilter rules and vice-versa.
-
Hit counts are not available for rules that use the Monitor action.
|
Before you begin
If you use custom user roles, ensure that the roles include the following privileges:
-
View Device, to see the hit counts.
-
Modify Device, to refresh the hit counts.
Procedure
Step 1 | In the access control policy or prefilter policy editor , click
Analyze Hit Counts on the top-right of the
page. |
Step 2 | On the Hit Count page, select the device from the Select a
device drop-down list.
If it is not the first time that you are generating hit counts for this
device, the last fetched hit count information appears next to the drop-down
box. Also, verify the Last Deployed time to confirm
recent policy changes.
|
Step 3 | If necessary, click Refresh
( ) to obtain current hit count data from the selected device.
In the prefilter policy, you might need to click Fetch Current Hit Count to get initial hit count data.
You cannot refresh the hit count while deployment to the device is in progress.
|
Step 4 | View and analyze the data.
You can do the following:
-
Click Prefilter or Access Control to switch between the hit counts for these policies.
-
Search for a specific rule by entering a search string in Filter box.
-
Broadly limit the list to Hit Rules or Never Hit Rules by selecting these options in the Filter by field. When viewing hit rules, you can further limit the list by selecting a time range in the In Last field (for example, in the last 1 day).
-
(When viewed from the access control policy.) You can do the following with individual rules:
-
Edit the rule by clicking Edit ( ).
-
Delete the rule from the policy by clicking Delete ( ).
-
Enable or disable the rule by clicking the Slider ( ).
-
Clear the hit count (reset it to zero) for the rule by clicking the X for the rule. You cannot undo this action.
-
(When viewed from the prefilter policy.) Change the displayed columns by clicking Cog ( ) and selecting the columns to show.
-
(When viewed from the prefilter policy.) Click on a rule name to edit it, or click View ( ) in the last column to view the rule details. Clicking on the rule name highlights it in the policy page where you can edit it.
-
(When viewed from the prefilter policy.) Clear the hit count information (reset it to zero) for a rule by right-clicking the rule and selecting Clear Hit Count. You can select multiple rules by using Ctrl+click. You cannot undo this action.
-
Generate a comma-separated values report of the details on the page
by clicking Generate CSV on the bottom-left
of the page.
|
Step 5 | Click Close to return to the policy page. |