The below result is mine understand:
icmp virtual session timeout:
there is a icmp virtual session timeout in global properties--stateful inspection.the default value of icmp virtual session timeout is 40s. FW will generate a icmp virtual session when a host have a icmp traffic,this virtual icmp session will keep 40s and only generate one log record.
All subsequent icmp traffic will match this virtual icmp session before this virtual session timeout,So there's only one log record, the one that starts with.
If virtual icmp session is timeout,all subsequent icmp traffic will generate a new log record.