Query regarding enabling Accounting on the Policy.

[Bachan]

Hi Team,

We have over 1500+ rules on our Management server on which Accounting is not enabled.

We are requested to enable Accounting on all the policy. Can you please help us in answering the below queries ?

• Is there any extra resource utilization on the firewall if Accounting is enabled on all the policy?
• Will there be increase in log volume on the firewalls or any delay in receiving the logs comparatively ? 

[PhoneBoy · Accepted solution]

For traffic that matches a rule where Accounting is required, there will be a small amount of additional overhead.
Specifically because every 10 minutes or so, the gateway sends an update to the log server on the session (number of bytes).

If you use an external SIEM, those updates also sent there at 10 minute intervals.
This can substantially increase the amount of logs sent to your SIEM.