Log Subtype

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Log Subtype

L3 Networker

Hi All,

I need some information on checking the logs. I see few things like END, DENY, SPYWARE, INFORMATION etc and in the action we see it as allowed. But the access will not be working. May i know what this Log Subtype means and what information will it give us in troubleshooting? When it says ALLOW as action then why in Subtype it is Deny. How to troubleshoot these issues?


Sanjay S


Cyber Elite
Cyber Elite

Hello @Sanjay_Ramaiah


in a Firewall a session is defined by two unidirectional flows each uniquely identified by a 6 tuple key: source IP address, destination IP address, source port, destination port, protocol, and source zone. If traffic has match for policy and the action of the policy is set to deny, then there is no further inspection and traffic is blocked with the log recorded as action: "deny" session end reason: "policy-deny".


In the case, the policy action is set to allow, then there is further L7 inspection where traffic can be eventually dropped based on further inspection. Here is the KB with more details. If you want to deep dive into exact reason for traffic being blocked click on magnifying glass icon on left hand side.


Kind Regards


Help the community: Like helpful comments and mark solutions.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!