View rule hit counts

Hit count indicates the number of times a policy rule or default action has been matched to a connection. The hit count is incremented only for the first packet of a connection that matches a rule. You can use this information to identify the efficacy of your rules. Hit count information is available only for access control and prefilter rules applied to Firewall Threat Defense devices.

Note

The count persists through reboots and upgrades.
Counts are maintained by each unit in an HA pair or cluster separately.
You will not be able to derive the hit count information from a device when deployment or a task is in progress on the device.
You can also see rule hit count information in the device CLI using the show rule hits command.
If you have accessed the Hit Count page from the Access Control Policy page, you will not be able to view or edit prefilter rules and vice-versa.
Hit counts are not available for rules that use the Monitor action.

Before you begin

If you use custom user roles, ensure that the roles include these privileges:

View Device, to see the hit counts.
Modify Device, to refresh the hit counts.

Follow these steps to view rule hit counts:

Procedure

Step 1

In the access control policy or prefilter policy editor, click Analyze > Manage Rule Hit Counts on the top-right of the page.

Step 2

On the Hit Count page, select the device from the Select a device drop-down list.

If it is not the first time that you are generating hit counts for this device, the last fetched hit count information appears next to the drop-down box. Also, verify the Last Deployed time to confirm recent policy changes.

Select All to see an aggregate of hit counts across all devices assigned to the policy.

Step 3

If necessary, click Refresh ( refresh icon ) to obtain current hit count data from the selected device.

In the prefilter policy, you might need to click Fetch Current Hit Count to get initial hit count data.

You cannot refresh the hit count while deployment to the device is in progress.

Step 4

View and analyze the data.

You can do these actions:

Click Prefilter or Access Control to switch between the hit counts for these policies.
Search for a specific rule by entering a search string in the Filter box.
Broadly limit the list to Hit Rules or Never Hit Rules by selecting these options in the Filter by field. When viewing hit rules, you can further limit the list by selecting a time range in the In Last field (for example, in the last 1 day).

(When viewed from the access control policy.) Clear the hit counts for one or more rule by selecting the checkbox for the rule, then clicking Clear Hit Counts. When confirming the action, choose Clear and Reload to refresh the hit count data. You can clear hit counts for up to 500 rules at a time. You cannot undo clearing hit counts.

Note	Click the checkbox in the table header to select all rules visible in the list. To select a range of rules, select the first rule's checkbox, then `Shift+click` the last rule's checkbox; all rules in between are also selected.

(When viewed from the access control policy.) You can do these actions with individual rules:
- Edit the rule by clicking Edit from the More () menu.
- Delete the rule from the policy by clicking Delete from the More () menu.
- Enable or disable the rule by clicking Enable Rule or Disable Rule from the More () menu.
- Clear the hit count (reset it to zero) for the rule by clicking Clear Hit Count from the More () menu. You cannot undo this action.
(When viewed from the access control policy.) You can do these actions with individual rules:
- Edit the rule by clicking Edit ().
- Delete the rule from the policy by clicking Delete ().
- Enable or disable the rule by clicking the Slider ().
- Clear the hit count (reset it to zero) for the rule by clicking the X for the rule. You cannot undo this action.
Change the displayed columns by clicking and selecting the columns to show. When viewed from the prefilter policy, use the Cog () to select the columns to display.
(When viewed from the prefilter policy.) Click on a rule name to edit it, or click View () in the last column to view the rule details. Clicking on the rule name highlights it in the policy page where you can edit it.
(When viewed from the prefilter policy.) Clear the hit count information (reset it to zero) for a rule by right-clicking the rule and selecting Clear Hit Count. You can select multiple rules by using Ctrl+click. You cannot undo this action.

Step 5

Optionally, you can generate a comma-separated values report of the details on the page by clicking Generate CSV on the bottom-left of the page.

Step 6

Click Close to return to the policy page.