Skip to content

Unable to get the hit_count from Panorama pre/post rules #598

@amruta-elisity

Description

@amruta-elisity

Describe the bug

Unable to get the hit_count from Panorama pre/post rules using RuleBaseHitCount with all_rules=True

Expected behavior

API should return a dictionary with rule_name as key and HitCount object with hit_count populated.

Current behavior

hit_count under HitCount Object for security rule is coming as None

Possible solution

Need to evaluate RuleBaseHitCount.refresh() API

Steps to reproduce

My sample code:

def fetch_panorama_rules_with_hit_counts(panorama_ip, api_key, device_group_name):
    # Connect to Panorama
    panorama = Panorama(hostname=panorama_ip, api_key=api_key)

    # Create and add device group
    dg = DeviceGroup(name=device_group_name)
    panorama.add(dg)

    # Add rulebase to the device group
    rulebase = PreRulebase()
    try:
        dg.add(rulebase)
    except Exception as e:
        print(f"Error while adding rulebase: {e}")
        return []
    info = rulebase.opstate.hit_count.refresh("security", all_rules=True)
    print(vars(info["amruta-pre-rule"]))

Screenshots

Sample Output:

{'obj': <SecurityRule amruta-pre-rule 0x71e341076170>, 'name': 'None', 'latest': None, 'hit_count': None, 'last_hit_timestamp': None, 'last_reset_timestamp': None, 'first_hit_timestamp': None, 'rule_creation_timestamp': 1750751413, 'rule_modification_timestamp': 1751350485}

On the other hand from CLI , i can see the hit count

show rule-hit-count device-group IoT_Firewalls pre-rulebase security rules all

Rule Name                                                         Rule usage          Device Name                         Vsys         Hit Count       Last Hit Timestamp            Last Reset Timestamp          First Hit Timestamp           Rule Create Timestamp        Rule Modify Timestamp         Last Received Update Timestamp          Device State     
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
amruta-pre-rule                                                  
                                                                  Used                PANW-BR2                            vsys1        320627          Wed Jul  2 04:49:39 2025      -                            Mon Jun 30 23:19:30 2025      Tue Jun 24 00:52:26 2025      Mon Jun 30 23:16:24 2025      Wed Jul  2 04:50:25 2025                connected        
Total Hit Count:     320627    

Context

we are unable fetch the rules from panorama who are using our DAG

Your Environment

  • Version used:
  • Software version:11.2.4-h2

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions