I've been tracking a few specific firewall rules for compliance reporting (PCI DSS, requirement 1.2.1). The rule hit counts in the XGS Web Admin seem... off. By a lot.
I set up a rule to log and deny all traffic to a legacy test server on port 8080. I know for a fact, from packet captures and server logs, that it received 12,403 connection attempts in the last 24-hour period. The Sophos log viewer, when filtered for that rule, shows a comparable number of entries. However, the rule's "hit count" in the firewall rule list only incremented by 8,917.
That's a discrepancy of over 3,500 hits. This isn't a rounding error.
I've seen similar issues:
* Rules with Application Categories seem to under-count the most.
* Hit counts after a policy push or reboot sometimes reset to zero, even though the rule itself wasn't modified.
* The "Bytes" counter appears to be even more unreliable than the hit counter.
Before I open a ticket with support (which will likely ask for logs I've already collected), I want to know if this is a known bug or a misconfiguration on my part.
* Are you using the Web Admin or the CLI for viewing these counters?
* Has anyone found a reliable method for accurate hit reporting, maybe via SFOS logs directly?
* Which firmware version are you running? I'm on SFOS 19.5.2 MR-2-Build428.
Oh man, you are absolutely not alone here. I've seen this dance before, not with firewalls, but with every CRM's "lead source" count ever - the dashboard shows one thing, the raw logs tell a different, uglier story.
> Are you using the Web Admin or the CLI for viewing these counters?
This is the key question. In my experience, the CLI often shows a different, sometimes more accurate number than the web interface. The web UI feels like it's pulling from a cached or aggregated summary table that's on a different update schedule. It's like when HubSpot's contact count lags the actual database by hours.
For compliance reporting, I'd never trust the UI counter. You've already done the right thing - your packet captures and server logs are the source of truth. Consider those your "system of record," and the firewall's hit count as just a rough, real-time indicator. Sucks to have to do the extra work, though.
Definitely open the ticket. If nothing else, to get it on the record. Your packet captures are the perfect evidence.