Thank you eelsasser!
It is ecsacly what I needed.
I have several questions:
1. Could you please clerify following fields:
2. What is the difference between evaluated and fired
3. Where I can find rule name by its ID
1. the timers that are in my log files are used for other purposes besides the rule counting. I use them to study other performance metrics when i need them. you can ignore them for your purposes.
2. Evaluated rules are rules that are hit, but are false and the action does not occur (like block actions, and events) Fired rules are rules whose criteri is true and the action occurs.
3. The ID is only visible if you a) export the rule and open the XML or b) use policyViewer to view the XML.