iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most production Palo Alto Networks security rules, use Log At Session End. It creates fewer log records, uses fewer resources, and records the final application identification and policy match. Enable Log At Session Start selectively for troubleshooting or when you need visibility into a session before it closes; for tunnel content inspection, Palo Alto Networks recommends logging both start and end.
What session-start and session-end logging record
Log At Session Start generates a traffic log when the first application-data packet is transmitted; it is not simply a record of the TCP handshake. As App-ID classifies traffic further, one connection can generate multiple start-related entries.
![Palo Alto PA-220 8-Port Next Gen Firewall Security Appliance w/ Power Adapter [No License] (Renewed)](https://m.media-amazon.com/images/I/21Q+X1-LrNL._SL160_.jpg)
Log At Session End generates one record when the session completes. It reflects the final App-ID and the security policy rule ultimately applied after identification has completed. Palo Alto Networks says end logging consumes fewer resources and can capture the exact application when identification changes after a few packets, such as from facebook-base to facebook-chat. See Building Blocks in a Security Policy Rule.
In PAN-OS security rule settings, start logging is disabled by default and end logging is enabled by default. The vendor discusses the trade-offs in its session logging considerations.
#1 Best Overall
Which setting fits your use case?
| Use case | Recommended setting | Why |
|---|---|---|
| Routine production security policy traffic | Session end | Lower resource use and final application identification. |
| Investigating an unexpected policy match or App-ID change | Start and end temporarily | Compare early and final records to see how classification and policy matching evolved. |
| Long-lived GRE or OT/ICS sessions where you need active-session visibility in ACC | Start and end | Waiting for a session to terminate can delay visibility. |
| Tunnel content inspection | Start and end | Palo Alto Networks recommends both; otherwise, a long-lived tunnel may not appear as an active tunnel in ACC until it terminates. See Configure Tunnel Content Inspection. |
| Some very short-lived sessions that may not produce an end log | Consider session start | Start logging may capture activity that end logging misses. |
Start logging can increase log volume and management-plane CPU load. Treat it as a targeted exception, and remove temporary troubleshooting settings when they are no longer needed. Palo Alto Networks also provides security policy rule best practices.
Where to configure logging and forwarding
Choose traffic-log timing in the security rule’s log settings or Actions area. A Log Forwarding profile controls where generated logs are sent; the start or end option controls when entries are generated, while the profile and its destinations determine where eligible logs go. See Configure Log Forwarding (PAN-OS).
Rank #2
![Palo Alto Software Palo Alto 3050 [PA-3050] Network Security Firewall Appliance (Renewed)](https://m.media-amazon.com/images/I/215S7tx0kNL._SL160_.jpg)
- Item Package Quantity - 1
- Product Type - ELECTRONIC SWITCH
- This pre-owned product has been professionally inspected, tested and cleaned by Amazon qualified vendors.
- Accessories may not be original, but will be compatible and fully functional. Product may come in generic box.
Why an end-log setting may not show every connection
Enabling end logging does not guarantee that every attempted connection will appear as an end traffic log. Possible causes include very short-lived or incomplete TCP sessions, forwarding misconfiguration or rate limits, lost connectivity to a log destination, full log storage, or logging-process failures. A threat-prevention drop may also be absent from the relevant threat logs.
When a session is missing, check threat logs and forwarding and storage health as well as traffic logs. Traffic-log fields include the subtype (start, end, drop, or deny), application, rule, action, bytes, elapsed time, and session end reason. A drop means the session was dropped before application identification and no rule allowed it; a deny means it was dropped after identification under a blocking or nonmatching policy condition. Field definitions are listed in Traffic Log Fields.
Rank #3
Balance visibility with privacy and log volume
Set logging scope to meet your compliance, audit, privacy, and SOC needs. Avoid exposing sensitive data such as credentials or personally identifiable information in cleartext. High-volume basic services such as DNS, NTP, and syslog can create many low-value entries and consume storage, so assess whether full traffic logging is useful for those rules or whether threat-log forwarding better fits the need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
