HA Pair setting is active-active and session-owner is primary-device : why logs on active-secondary fw ?

[Nogaro-STMicro]

Dear Gurus,

I've the following setup in a production environment :

• HA Pair setting: active-active (vWire)
• tla-zone-fw01:
  • HA3 session-owner = primary-device via local configuration (not template)
  • Device priority 50 = active-primary
• tla-zone-fw02:
  • HA3 session-owner = primary-device via local configuration (not template)
  • Device priority 100 = active-secondary

I understood the following regarding this setup from PAN documentation: Setting Session Owner and Session Setup to Primary Device causes the active-primary firewall to perform all traffic processing. Only the firewall that is the session owner creates a traffic log.

However, I have dissimilar logs on both - whereas I was expecting only on fw01 as the active-primary to treat and log all traffic (fw02 to forward packets to fw01 for treatment), leading me to believe that in fact these are acting in a active-active + first-packet setup, rather than in a active-active + primary-device setup.

The active-active setup is required for fastest fail-over with least risk to loosing sessions (high speed transactions network).

What I am missing in the understanding of this setup please?

Thanks in advance !