Monitoring Statistics Logs

Last updated
Save as PDF

For supported software information, click here.

Monitoring statistics logs send usage statistics related to stateful firewall, NGFW firewalls, and SD-WAN circuits and VRFs. These statistics do not include the standard SD-WAN encapsulation overhead.

The following table explains the fields in the monitoring statistics logs messages. The format for all monitoring statistics logs is identical.

Field	Description
applianceName	Name of the Versa Operating System^TM (VOS^TM) device. This is the name displayed in the output of the show system identification branch CLI command.
tenantName	Name of the organization (tenant).
mstatsTimeBlock	Time when the when the log was generated, in UNIX epoch time format.
tenantId	Tenant identifier. This value is allocated internally by the VOS device.
vsnId	Identifier of the virtual service node, or virtual machine (VM).
mstatsTotSentOctets	Number of bytes sent in the last measurement interval.
mstatsTotRecvdOctets	Number of bytes received in the last measurement interval.
mstatsTotSessCount	Number of sessions closed in the last measurement interval.
mStatsType	Type of statistics: app-stats—NGFW firewall application statistics dest-stats—Firewall destination IP statistics fc-stats—Firewall forwarding class statistics rule-stats—Firewall rule statistics sdwan-acc-ckt-app-stats—SD-WAN statistics per access circuit sdwan-acc-ckt-stats—SD-WAN access circuit statistics sdwan-site2site-stats—SD-WAN site-to-site statistics sdwan-vrf-stats—SD-WAN LAN VRF statistics service-stats—Firewall service statistics src-stats—Firewall source IP address statistics url-rep-stats—NGFW firewall URL reputation statistics urlc-stats—URL statistics zone-stats—Firewall zone statistics
Statistics Identifiers	Some of the mStatsType statistics types have additional fields that provide information about the statistics.
SD-WAN statistics identifiers	sdwan-acc-ckt-stats localSiteId localSiteName localWanLinkId localWanLinkName sdwan-acc-ckt-app-stats app localSiteId localSiteName localWanLinkId localWanLinkName sdwan-site2site-stats localSiteId localSiteName localWanLinkId localWanLinkName remoteSiteId remoteSiteName remoteWanLinkId remoteWanLinkName sdwan-vrf-stats lan-interface lan-vrf localSiteId localSiteName localWanLinkId localWanLinkName native \| sdwan
Security Statistics Identifiers	app-stats—appId dest-stats—dest-ip fc-stats—forwarding class rule-stats—rule service-stats—stats-type src-stats—src-ip urlc-stats—urlCategory url-rep-stats—urlReputation zone-stats—zone
Additional Attributes	Some monitoring objects have additional attributes: app-stats family productivity risk subfamily sdwan-acc-ckt-app-stats business/non-business tag family productivity risk subfamily

Firewall Destination IP Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=0, mstatsTotRecvdOctets=300, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=dest-stats, destIp=169.254.169.254, mstatsAttribs=

Firewall Forwarding Class Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=10, mstatsType=fc-stats, fc=fc_be, mstatsAttribs=

Firewall Rule Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=rule-stats, rule=r1, mstatsAttribs=

Firewall Service Statistics

Log Message Format

20171126T130854.txt:2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, 
mstatsTimeBlock=1511730600, tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, 
mstatsTotSessDuration=300000, mstatsTotSessCount=5, mstatsType=service-stats, type=allow, mstatsAttribs=

Firewall Source IP Address Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=0, mstatsTotRecvdOctets=300, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=src-stats, srcIp=172.21.1.2, mstatsAttribs=

Firewall Zone Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=zone-stats, zone=trust, mstatsAttribs=

NGFW Firewall Application Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=app-stats, appId=unknown_tcp, risk=2, productivity=2, family=networking, 
subFamily=unknown

NGFW Firewall URL Reputation Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=300, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=5, mstatsType=url-rep-stats, urlReputation=undefined, mstatsAttribs=

SD-WAN Access Circuit Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=180, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=3, mstatsType=sdwan-acc-ckt-stats, site=Branch1, accCkt=MPLS, siteId=101, accCktId=2, 
accessType=DIA, mstatsAttribs=

SD-WAN Application Statistics for an Access Circuit

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=180, mstatsTotRecvdOctets=0, mstatsTotSessDuration=300000, 
mstatsTotSessCount=3, mstatsType=sdwan-acc-ckt-app-stats, appId=unknown_tcp, site=Branch1, accCkt=MPLS, 
siteId=101, accCktId=2, user=172.21.1.2, risk=2, productivity=2, family=networking, 
subFamily=unknown, bzTag=Unknown

SD-WAN LAN VRF Statistics

Log Message Format

2017-11-26T21:08:59+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511730600, 
tenantId=1, vsnId=0, mstatsTotSentOctets=0, mstatsTotRecvdOctets=180, mstatsTotSessDuration=300000, 
mstatsTotSessCount=3, mstatsType=sdwan-vrf-stats, vrf=Customer1-LAN-VR, vni=vni-0/2.0, sdwan=0, site=Branch1, 
accCkt=MPLS, siteId=101, accCktId=2, mstatsAttribs=

SD-WAN Site-to-Site Statistics

Log Message Format

2017-11-26T22:24:01+0000 monStatsLog, applianceName=Branch1, tenantName=Customer1, mstatsTimeBlock=1511735100, 
tenantId=1, vsnId=0, mstatsTotSentOctets=31414728, mstatsTotRecvdOctets=1068628, mstatsTotSessDuration=300000, 
mstatsTotSessCount=82, mstatsType=sdwan-site2site-stats, localSite=Branch1, localAccCkt=MPLS, remoteSite=Branch2, 
remoteAccCkt=MPLS, localSiteId=101, localAccCktId=102, remoteSiteId=2 remoteAccCktId=2, mstatsAttribs=

Supported Software Information

Releases 20.2 and later support all content described in this article.

Additional Information

Analytics Log Collector Log Types Overview