For every transaction happening in Cisco Firewall, an rule
configured in it matches. This matched policy along with complete
transaction detail is audited through Message-ID 106100. Please follow
the below link which provides more information about the same. This
message identifier will provide information for both accepted and
denied transactions.
The
log containing the above information is forwarded to Firewall Analyzer
machine via syslog. We parse these information to get the "Used"
rules. This information is populated in "Firewall Rules Report" -->
"Top Used Rules" report.
Categorization is based on ACL group and not based on ACL entries.
The information that is provided by Cisco as part of syslog message is
the "ACL" name. So with the help of complete access-list fetched from
the firewall, we can show "Unsed Rules" based on "ACL" and not fine
grained to ACL entries.
To find out which
particular ACL entry is used or not, please click on the particular
rule name in "Firewall Rules Report" --> "Top Used Rules", you will
be able to see the entries in it with corresponding hit count.