Log generation setting on the track settings

[Albin_Petersson]

Helloes.

I am starting to think i don't quite understand the functionality of the log generation. 

My goal: i'd like to reduce the "clutter" in the log views by only viewing sessions instead of a mix of connections and sessions.

I understood it as follows: Firewall blade cannot generate session logs, they're only per connection.

all other blades can and will clump together connections to a session log, if you have both per connection and per session checked.

But in R80.20 it seems like the firewall blade can generate sessions from connection logs? 
Or, what does Enable Firewall sessions do exactly. It's not even mentioned in the docs?

Can you uncheck per connection generation and still see all the connections in the logs now then? 

[Amir_Senn]

In Access Control policy:

Connections are firewall only

Session could be Firewall/URL Filtering/Application Control/Content Awareness

If you want to generate extra session for Firewall for a rule that creates Firewall/URL Filtering/Application Control/Content Awareness you can check the "Enable Firewall Session".

If you don't want to see connection you can use one of the following queries (they are not equal because there are more types): "type:(Log OR Session)" or "NOT type:Connection"

If you don't want to generate them at all, just select Session in the rules.

[Albin_Petersson]

If you want to generate extra session for Firewall for a rule that creates Firewall/URL Filtering/Application Control/Content Awareness you can check the "Enable Firewall Session".

...do you mean that you get a session from the firewall blade in addition to the URLF/Application session? What are the use case for this, or where would it be useful?

If I don't log connections, just sessions, do I get session logs for things that aren't really sessions? like DHCP requests, or UDP? 

[Amir_Senn]

Yes, the I got an extra Firewall over there. I'm not sure what is the use-case for that, perhaps for analyzing.

You'll probably have connection that are marked as logs, those come from implied rules/anti-spoofing. Anything enforced by Access Control policy should be sessions only if that's the only thing you marked.