AppFlow Report combines IP address data into "Remaining IPs"

Mariusz

When I go into AppFlow Reports and I choose "View: Since Last Reset", it is naming IP addresses as “Remaining IPs” instead of listing the actual IP's address. If I choose "View: all" and choose "Limit Unlimited" there are only 12500 IP's.
AppFlow Report collects only 12500 IP addresses max. After that number all the rest are combined into "Remaining IPs". Does this have anything to do with the fact that data writing to the M.2 Storage Device is enabled?

TZ370, SonicOS 7.1.3-7015

BWC

I guess there is a limit based on the performance of the Appliance, not using the Storage Device for that. For TZ 470 it's the same 12500, TZ 670 / NSa 2700 it seems to be 25000 and a NSa 4700 can keep 50000 IPs.

On-box analytics was never the strong suit of SNWL Firewall.

Update: the TSR holds some information about the limits, e.g. for a TZ 670

IP/User AppFlow Report Settings
-------------------------------
 gEnableIpReport      =1
 gEnableUserReport    =1
 gMaxNumOfIpRecords   =25000
 gMaxNumOfUserRecords =10000
 gMaxHashIpBuckets    =4096
 gMaxHashUserBuckets  =2048
 gIpHashMask          =4095
 gUserHashMask        =2047

 currIpReportRecords  =18071
 currUserReportRecords=1

—Michael@BWC

Mariusz

This is not good news for me. The information given in /Device/Settings/Storage/Secondary" indicates that the space for collecting AppFlow Reports is 964.00 KB/3.20 GB - used/available - i.e. practically all free. I see no reason why not to store data on SSD in files similar to System Logs, where I currently see a lot of files and in each 12500 number of logs. This is exactly what the additional SSD M.2 Storage Device is for. They should change this in the new Firmware version.

What is the CLI command to display this information?
How can I reset (delete current) data collection in AppFlow Report?