Weekly Firewall Report with Rules hit counter (like ACL Counter on Cisco ASA)

Question

Hello Sophos-Community, 
 
 is there any possibility to get an Report of "which Firewall Rules match how many times" like the hit counter on a Cisco ASA. 
 I'm using a Sophos SG105 (UTM 9.703-3) 
 
 Thank you very much :) 
 Best Regards, Jonas

emmosophos · Accepted Answer

Hello Jonas, 
 Thank you for contacting the Sophos Community. 
 Unfortunately, the UTM doesn't have this Report. 
 Regards, 
 Emmanuel Osorio

BAlfson · Answer

Hallo Jonas and welcome to the UTM Community! 
 What you can do is have each rule log packets and then gather the info at the command line. For example, the number of times each Allow rule has been hit this month would be: 
 zgrep accept /var/log/packetfilter/2020/07/*|grep -oP 'fwrule=".*?"'|sort -n|uniq -c 
 By the same token, you could see the drops with: 
 zgrep drop /var/log/packetfilter/2020/07/*|grep -oP 'fwrule=".*?"'|sort -n|uniq -c 
 You can also choose to log the automatic firewall rules. 
 Note that this approach will balloon the size of the firewall log files, so I wouldn't leave logging activated for longer than to test your configuration. 
 Cheers - Bob