log at session end?

[SThatipelly]

I have around 500 policies having 'log at session end' enabled and 'log at session start' disabled. I know Palo recommends logging at session end only but I also have a concern that for eg. a malicious file export that lasts for 8 hours and 10gigs go unnoticed if the session wasn't logged at the start. I am in a dilemma to enable the logging at start or not. Please shed some light on this.

Thanks.

[BPry · Accepted solution]

@SThatipelly,

So the thing to keep in mind is that (in a normal configuration) the firewall will be analyzing the session looking for things like vulnerabilities or malicious files already. If it identifies anything, it'll generate the log for the identification and likely close the session at the same time depending on how you have things configured. 

In the event that you simply want to know that you have a long-running session being used to transfer files, logging at session start really wouldn't give you any additional information there through traffic logs. It's just going to log the start and end of the session. You really need to be monitoring the current sessions traffic to really can actionable information from that regard, which would generally be done via netflow monitoring or using SNMP/API to monitor the session table.