Staff & Editor

Technical Tip: Difference between 'Security Events' and 'All session' in Log Allowed Traffic in Firewall Policy

Description

This article describes the difference between 'Security Events' and 'All sessions' in Log Allowed Traffic in Firewall Policy.

Scope

FortiGate.

Solution

All Sessions: Logs every single connection accepted or denied by the policy, providing a complete record of all traffic flow.
Security Events (UTM): Logs only the specific traffic that matches or triggers an active security profile (such as Antivirus, Web Filter, or IPS) applied to the policy.
Disable: Prevents the firewall from generating any traffic logs for sessions matching the policy.

To edit the firewall policy logging in the web GUI:

To edit the firewall policy logging on the CLI:

config firewall policy
    edit 1
       set logtraffic {all | utm | disable}
    next
end

Sign up