Log at session start??

SeanDeHarris — Wed, 16 Mar 2022 16:47:55 GMT

Hello everyone,

What I read the best practice is to enable log at session end, is there any use case to enable log at session start?

any thoughts?

thanks

Re: Log at session start??

thrtnastrx2 — Wed, 16 Mar 2022 17:10:17 GMT

If you want to log Deny or if you are troubleshooting a policy, enable "log at session start"

Re: Log at session start??

Adrian_Jensen — Wed, 16 Mar 2022 22:55:57 GMT

You don't need to log at start in a deny rule to get a log entry. But logging at start can be useful in debugging:

1) Sessions that are long running - You get an initial log when the connection starts, and then another entry hours later when the connection ends. You don't have to look at Session Browser to try and pick out a live connection (the filtering tools in Session Browser are far more limited than Traffic Log).

2) Session parameters change over time - The connection is initially allowed in one rule, but then later the AppID reclassifies the connection which matches a different rule (i.e. the start log shows it as allowed under a rule "source->dest web-browsing allow", but the end log shows it under a different rule "src->dest social-media-whatever block").

topic Re: Log at session start?? in General Topics

Log at session start??

Re: Log at session start??

Re: Log at session start??