Log consumption in rules

[erpersa]

Hi guys,

I have two FortiGate 600D in a cluster with FortiOS 5.4.4. I'd like to know how can I get a list of the firewall rules with the most log consumption.

Thank you and regards,

Erpersa.

[emnoc]

What do you mean by log consumption? If you don't have logging enable on that rule than it will not consume anything.

You can look at the  hit-count per fwpolicy over let's say a time interval to get a list of what's being hit

cli cmd diag firewall iprope show 100004  <fwpolicy id> might be useful also if you want to  do thing via the cli

FWIW: if you have  FAZ or syslog, you can  look at the log-rate per/second also.

[erpersa]

Thank you for your answer. I mean, we are close to the number of logs licensed in FAZ and we want to know which firewall policies are generating more logs to decide which ones are deactivated.