For most Palo Alto Networks production security rules, choose Log At Session End. It creates one record with the final application identification and policy match while using fewer resources. Use Log At Session Start selectively when early visibility matters, such as during troubleshooting or for certain long-lived sessions; for tunnel content inspection, Palo Alto Networks recommends logging both start and end.
What session-start and session-end logging record
Log At Session Start creates a traffic log when the first application-data packet is transmitted—not merely when the TCP handshake occurs. As App-ID classifies traffic further, a connection can generate multiple start-related entries.
![Palo Alto PA-220 8-Port Next Gen Firewall Security Appliance w/ Power Adapter [No License] (Renewed)](https://m.media-amazon.com/images/I/21Q+X1-LrNL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Log At Session End creates a single traffic log when the session completes. By then, the firewall can record the final App-ID and the security policy rule ultimately applied. Palo Alto Networks says session-end logging consumes fewer resources and can identify the exact application when classification changes after the first few packets, such as from facebook-base to facebook-chat (Building Blocks in a Security Policy Rule).
In the cited PAN-OS security-rule documentation, session-start logging is disabled by default and session-end logging is enabled by default. The exact interface wording and location can vary by PAN-OS version.
#1 Best Overall
Which logging option to use
| Use case | Recommended setting | Why |
|---|---|---|
| Routine production policy traffic | Session end | Provides the final application and rule match with lower resource use. |
| Diagnosing an unexpected policy match or App-ID change | Start and end temporarily | Lets you compare early and final records to see how classification and matching evolved. |
| Long-lived GRE or OT/ICS sessions where active visibility matters | Start and end | Waiting for a session to terminate can delay visibility in ACC. |
| Tunnel content inspection | Start and end | Palo Alto Networks recommends both because long-lived tunnels may otherwise remain invisible as active tunnels in ACC until they terminate (Configure Tunnel Content Inspection). |
| Some very short-lived sessions | Consider session start | Vendor documentation identifies cases where a session may not produce an end log. |
Use session-start logging as a targeted exception rather than a blanket setting: it can increase log volume and management-plane CPU load. If enabled to investigate a specific issue, reassess the rule and remove the extra logging when it is no longer needed. Palo Alto Networks’ Session Logging Considerations and Security Policy Rule Best Practices provide additional context.
Where to configure it and where logs go
Choose the start or end option in the security rule’s logging settings or Actions area. The rule may also use a Log Forwarding profile. The timing option controls when traffic log entries are generated; the profile and its destinations control where eligible logs are sent. See Palo Alto Networks’ Configure Log Forwarding (PAN-OS).
Rank #2
![Palo Alto Software Palo Alto 3050 [PA-3050] Network Security Firewall Appliance (Renewed)](https://m.media-amazon.com/images/I/215S7tx0kNL._SL160_.jpg)
- Item Package Quantity - 1
- Product Type - ELECTRONIC SWITCH
- This pre-owned product has been professionally inspected, tested and cleaned by Amazon qualified vendors.
- Accessories may not be original, but will be compatible and fully functional. Product may come in generic box.
Why a session may be missing from traffic logs
Enabling end logging does not guarantee a traffic-log record for every attempted connection. Palo Alto Networks documents several possible causes of missing entries:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- The session was too short-lived or the TCP session did not complete.
- Log forwarding is misconfigured or subject to rate limits, or the destination is unreachable.
- Log storage is full or a logging process has failed.
- A threat-prevention action dropped traffic without a corresponding entry in the threat log you are checking.
When a traffic log is absent, check the relevant threat logs and the health of forwarding and storage as well as the traffic log itself. Traffic-log fields include the subtype—start, end, drop, or deny—along with items such as application, rule, action, bytes, elapsed time, and session end reason. A drop indicates the session was dropped before application identification and no rule allowed it; a deny indicates it was dropped after application identification under a blocking or nonmatching policy condition. Field definitions are available in Traffic Log Fields.
Rank #3
Set logging scope with privacy and value in mind
Choose what to log based on operational visibility, audit and compliance requirements, privacy obligations, and available storage. Palo Alto Networks cautions against exposing sensitive information such as credentials or personally identifiable information in cleartext. High-volume basic services such as DNS, NTP, and syslog can produce many low-value entries; consider whether full traffic logging on those rules is useful, or whether threat-log forwarding better serves the monitoring need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
