opnsense_get_rule_statistics
Retrieve per-rule pf counters from OPNsense to identify which firewall rules are used or unused. Filter by interface or label and flag rules with zero evaluations since the last apply.
Instructions
Get per-rule pf counters: how many times each rule was evaluated, and how many packets, bytes and states it accounted for.
This turns "which rules actually matter" into a data question. Counters reset every time the ruleset is reloaded, so a zero count means "not matched since the last apply", not "never matched". Confirm the ruleset has been stable for a while before concluding a rule is dead.
Args: params (RuleStatisticsInput): Validated input containing: - search (str): Filter on rule label or interface (default: "") - unused_only (bool): Only rules with zero evaluations (default: False) - limit (int): Max records, 1-200 (default: 25) - offset (int): Records to skip (default: 0) - response_format (ResponseFormat): 'markdown' or 'json'
Returns: str: Markdown table, or JSON with this schema: { "total": int, "count": int, "offset": int, "has_more": bool, "next_offset": int|null, "rule_stats": [ {"label": str, "evaluations": int, "packets": int, "bytes": int, "states": int, "interface": str} ] }
Examples: - Use when: "Which rules are never hit?" -> unused_only=True - Use when: "How much traffic does the guest block rule see?" -> search="guest"
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |