Log at session start??

[SeanDeHarris]

Hello everyone,

What I read the best practice is to enable log at session end, is there any use case to enable log at session start?

any thoughts?

thanks

[thrtnastrx2]

If you want to log Deny or if you are troubleshooting a policy, enable "log at session start"

[Adrian_Jensen]

You don't need to log at start in a deny rule to get a log entry. But logging at start can be useful in debugging:

1) Sessions that are long running - You get an initial log when the connection starts, and then another entry hours later when the connection ends. You don't have to look at Session Browser to try and pick out a live connection (the filtering tools in Session Browser are far more limited than Traffic Log).

2) Session parameters change over time - The connection is initially allowed in one rule, but then later the AppID reclassifies the connection which matches a different rule (i.e. the start log shows it as allowed under a rule "source->dest web-browsing allow", but the end log shows it under a different rule "src->dest social-media-whatever block").