https://live.paloaltonetworks.com/t5/general-topics/session-time-out-need-some-understanding/m-p/288270#M76823 there's idle timeout, which is a relatively short time and those ar ethe 'different' times you are seeing, it's the idle timeout decreasing with inactivity the session time of 14400 is the lifetime counter, which allows a session to be open for an amount of time. for TCP this is usually 24 hours. this means the first session you screenshot is an ended session while the 2 below that are active sessions with their counters still going Fri, 13 Sep 2019 09:53:29 GMT reaper 2019-09-13T09:53:29Z https://live.paloaltonetworks.com/t5/general-topics/session-time-out-need-some-understanding/m-p/287954#M76779 <P>We hare seeing some oracle session being aged-out. When i checked session info tim-out it says 120sec. But the application time-out itself is for 14400 sec . Where does this value of 120 sec come from.</P><P>&nbsp;</P><P>&nbsp;</P><PRE>Session 2071980 c2s flow: source: x.x.x.x [SERVER2] dst: y.y.y.y proto: 6 sport: 36082 dport: 1521 state: INIT type: FLOW src user: unknown dst user: unknown s2c flow: source: y.y.y.y [DBASE] dst: x.x.x.x proto: 6 sport: 1521 dport: 36082 state: INIT type: FLOW src user: unknown dst user: unknown Slot : 1 DP : 0 index(local): : 2071980 start time : Wed Sep 11 11:25:47 2019 timeout : 120 sec total byte count(c2s) : 500 total byte count(s2c) : 3353 layer7 packet count(c2s) : 4 layer7 packet count(s2c) : 14 vsys : vsys2 application : oracle session to be logged at end : True session in session ager : False session updated by HA peer : False layer7 processing : enabled URL filtering enabled : True URL category : any session via syn-cookies : False session terminated on host : False session traverses tunnel : False captive portal session : False ingress interface : ae2.20 egress interface : ae2.21 session QoS rule : N/A (class 4) end-reason : aged-out</PRE><P>Also below are 2 session on port 443 and both have different time-outs</P><PRE>Session 2105535 c2s flow: source: f.f.f.f [CAPUGUEST] dst: m.m.m.m proto: 6 sport: 54046 dport: 443 state: INIT type: FLOW src user: unknown dst user: unknown qos node: ae1.100, qos member N/A Qid 0 s2c flow: source: m.m.m.m [EXTERNAL] dst: g.g.g.g proto: 6 sport: 443 dport: 63335 state: INIT type: FLOW src user: unknown dst user: unknown qos node: ae1.149, qos member N/A Qid 0 Slot : 1 DP : 0 index(local): : 2105535 start time : Wed Sep 11 12:20:02 2019 timeout : 30 sec</PRE><P>&nbsp;</P><PRE>Session 2071235 c2s flow: source: a.a.a.a [EXTERNAL] dst: b.b.b.b proto: 6 sport: 35585 dport: 443 state: INIT type: FLOW src user: unknown dst user: unknown qos node: ae1.8, qos member N/A Qid 0 s2c flow: source: j.j.j.j [DMZN] dst: a.a.a.a proto: 6 sport: 443 dport: 35585 state: INIT type: FLOW src user: unknown dst user: unknown qos node: ae1.100, qos member N/A Qid 0 Slot : 1 DP : 0 index(local): : 2071235 start time : Wed Sep 11 11:39:18 2019 timeout : 15 sec</PRE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 11 Sep 2019 19:51:51 GMT https://live.paloaltonetworks.com/t5/general-topics/session-time-out-need-some-understanding/m-p/287954#M76779 raji_toor 2019-09-11T19:51:51Z https://live.paloaltonetworks.com/t5/general-topics/session-time-out-need-some-understanding/m-p/288270#M76823 there's idle timeout, which is a relatively short time and those ar ethe 'different' times you are seeing, it's the idle timeout decreasing with inactivity the session time of 14400 is the lifetime counter, which allows a session to be open for an amount of time. for TCP this is usually 24 hours. this means the first session you screenshot is an ended session while the 2 below that are active sessions with their counters still going Fri, 13 Sep 2019 09:53:29 GMT https://live.paloaltonetworks.com/t5/general-topics/session-time-out-need-some-understanding/m-p/288270#M76823 reaper 2019-09-13T09:53:29Z