Traffic logs show wrong rule taken in GUI, but is shown as correct in the CLI

Issue

In GUI, when seeing Monitor > Logs > Traffic, the rule shown is incorrect.

However, when seeing 'show session <session ID>' for the same session ID through CLI, we see that the rule is taking expected rule.

It appears that traffic is taking the wrong security policy or that there is inconsistency while processing traffic.

Cause

This is an expected behavior.

The firewall tried to match first security rule while still identifying the correct app and decoding the traffic.

Once it is available, the correct rule is shown in GUI after some time.

Resolution

1. Go to the Security Policy rule > Actions tab > Log Setting.
2. Disable "Log at Session Start" (if enabled).
3. Only enable "Log at session End."