show security policies hit-count
Syntax
show security policies hit-count<ascending> <descending> <dynamic-applications> <from-zone zone-name> <greater-than count> <less-than count> <logical-system (logical-system-name | all)> <root-logical-system> <tenant (tenant-name | all)> <to-zone zone-name> <url-categories>
Description
Display the utility rate of security policies by listing the number of times a security policy rule matches the traffic (number of hits). You can specify the options to list the output in ascending or descending order. You can specify the range to display security policies with certain number of hits. You can filter the output by zones, logical or tenant systems, dynamic applications, and URL categories.
When the device is operating in chassis cluster mode, the count displayed is a sum of all the Services Processing Cards (SPC) hit counts in the cluster setup. The security device retains the count if a Packet Forwarding Engine (PFE) in a node is in failover mode, but does not reboot. . The device clears the count if a node reboots and the PFE in the node also reboots. During an in-service software upgrade (ISSU), all PFEs reboot, therefore all counters are cleared.
Use this command without options to display the number of hits in random order for all security policies and for all zones.
The show security policies hit-count command with to-zone
and from-zone options work for zone-based policies only and not for global
policies.
Options
-
ascending—(Optional) Displays the number of hits for security policies in ascending order. -
descending—(Optional) Displays the number of hits for security policies in descending order. -
dynamic-applications—(Optional) Displays the number of hits for security policies configured with dynamic applications.When you display the policy count for the dynamic applications, the device considers the count for the final matched application identification. For example, if the traffic’s classification path is: HTTP:FACEBOOK-ACCESS:FACEBOOK-CHAT, then the count increases only for FACEBOOK-CHAT.
-
from-zone zone-name—(Optional) Displays the number of hits for security policies associated with the named source zone. -
greater-than count—(Optional) Displays security policies for which the number of hits is greater than the specified number.Range: 0 through 4,294,967,295
-
less-than count—(Optional) Displays security policies for which the number of hits is less than the specified number.Range: 0 through 4,294,967,295
-
logical-system—Displays the logical system name. -
root-logical-system—Displays the number of hits for security policies configured for a root logical system. -
tenant—Displays the number of hits for security policies configured for the tenant system. -
to-zone zone-name—(Optional) Displays the number of hits for security policies associated with the named destination zone. -
url-categories—(Optional) Displays the number of hits for security policies based on the matching URL categories.
Required Privilege Level
view
Output Fields
#show-security-policies-hit-count__show-security-policy-hit-count-tbl lists the
output fields for the show security policies hit-count command. Output fields
are listed in the approximate order in which they appear.
show security policies hit-count Output Fields
|
Field Name |
Field Description |
|---|---|
|
|
Displays the line number |
|
|
Name of the source zone |
|
|
Name of the destination zone |
|
|
Name of the security policy |
|
|
Number of hits for each security policy |
|
|
Displays the name of the tenant system. |
| Action | Policy action - Permit or Deny. |
| Redirect | Number of permitted sessions that are redirected by the policy |
| Dynamic-applications | Details of the dynamic applications.
|
| url-categories | Details of the URL categories.
|
Sample Output
show security policies hit-count
user@host> show security policies hit-count index from zone to zone name policy count 1 untrust vrtrust policy1 40 2 untrust trust policy2 20 3 untrust trust policy3 80 Number of policy: 3
Sample Output
show security policies hit-count ascending
user@host> show security policies hit-count ascending index from zone to zone name policy count 2 untrust trust policy2 20 1 untrust vrtrust policy1 40 3 untrust trust policy3 80 Number of policy: 3
Sample Output
show security policies hit-count descending greater-than 70 less-than 100
user@host> show security policies hit-count descending greater-than 70 less-than 100 index from zone to zone name policy count 2 untrust trust policy2 100 1 untrust vrtrust policy1 90 3 untrust trust policy3 80 Number of policy: 3
Sample Output
show security policies hit-count from-zone untrust to-zone trust
user@host> show security policies hit-count from-zone untrust to-zone trust index from zone to zone name policy count 2 untrust trust policy2 20 3 untrust trust policy3 80 Number of policy: 2
Sample Output
show security policies hit-count
user@host> show security policies hit-count Logical system: root-logical-system Index From zone To zone Name Policy count Action 1 junos-global junos-global policy1 5202 Permit
Sample Output
show security policies hit-count detail
user@host> show security policies hit-count detail Logical system: root-logical-system Index From zone To zone Name Policy count Action Redirect 1 junos-global junos-global policy1 5202 Permit 0 2 junos-global junos-global policy2 5202 Reject 3
Sample Output
show security policies hit-count policy-name policy-name detail url-categories
user@host> show security policies hit-count policy-name policy1 detail url-categories Logical system: root-logical-system Index From zone To zone Name Policy count Action Redirects 1 junos-global junos-global policy1 5202 Permit 0 URL-Categories Name Count Enhanced_Information_Technology 1000 Enhanced_Collaboration_Office 2000
Sample Output
show security policies hit-count policy-name policy-name detail dynamic-applications
user@host> show security policies hit-count policy-name policy1 detail dynamic-applications Logical system: root-logical-system Index From zone To zone Name Policy count Action Redirect 1 junos-global junos-global policy1 5202 Permit 0 Dynamic-applications Name Application Count Junos:SSH 2234 Junos:HTTP 2502 Junos:TWITTER 529
Release Information
Command introduced in Junos OS Release 12.1.
The tenant option is introduced in Junos OS Release 18.3R1.
The dynamic-applications and url-categories options are
introduced in Junos OS Release 21.2R1.