The same application is detected differently in Forward Traffic logs and Application Control logs.
Forward Traffic logs:
date=2026-03-20 time=13:50:53 itime=2026-03-20 13:50:54 euid=1206 epid=1077 dsteuid=3 dstepid=101 type=traffic subtype=forward level=notice action=close utmaction=allow policyid=84 sessionid=764223496 srcip=192.168.200.10 dstip=104.18.29.234 transip=217.92.185.23 srcport=57807 dstport=443 transport=57807 trandisp=snat duration=1 proto=6 sentbyte=2198 rcvdbyte=3807 sentpkt=10 rcvdpkt=8 logid=0000000013 unauthuser=Jan srcname=W11-JS-NB01 dstname=104.18.29.234 service=Cloudflare-CDN app=SSL_TLSv1.3.PQC appcat=Network.Service srcintfrole=lan dstintfrole=wan srcserver=0 appid=56688 apprisk=medium policytype=policy eventtime=1774011053510993349 vwlid=4 wanin=3475 wanout=1786 lanin=1786 lanout=3475 crscore=5 craction=262144 crlevel=low countapp=4 countweb=1 srcuuid=9755ddac-6a5c-51e8-03ac-daf201300997 dstuuid=9755ddac-6a5c-51e8-03ac-daf201300997 poluuid=739c0ec2-796e-51ea-28d8-1082e2b08093 srcmac=80:6d:97:58:ff:02 mastersrcmac=80:6d:97:58:ff:02 srcswversion=10/11 osname=Windows srccountry=Reserved dstcountry=United%20States srcintf=vlan.200 dstintf=wan.tcom dstinetsvc=Cloudflare-CDN unauthusersource=kerberos applist=ApplicationFilter-Global policyname=Web Servicest vwlquality=Seq_num(2 wan.tcom virtual-wan-link), alive, selected msg=Connection%20Failed hostname=104.18.29.234 catdesc=Artificial Intelligence Technology tz=+0100 dstregion=Undefined dstcity=Undefined vwlname=All dstreputation=4 srcgeoid=0 dstgeoid=0 devid=FG200FTXXXXX vd=root dtime=2026-03-20 13:50:53\
Application Control logs:
date=2026-03-20 time=13:50:52 itime=2026-03-20 13:50:53 euid=3 epid=1077 dsteuid=3 dstepid=101 type=utm subtype=app-ctrl level=information action=pass sessionid=764223496 policyid=84 srcip=192.168.200.10 dstip=104.18.29.234 srcport=57807 dstport=443 proto=6 logid=1059028704 service=SSL eventtime=1774011052442908842 incidentserialno=115670755 direction=outgoing apprisk=low appid=57416 srcintfrole=lan dstintfrole=wan applist=ApplicationFilter-Global appcat=GenAI app=xAI.Grok hostname=cdn.grok.com url=%2F eventtype=signature srcintf=vlan.200 dstintf=wan.tcom msg=GenAI%3A%20xAI.Grok tz=+0100 policytype=policy srccountry=Reserved dstcountry=United%20States poluuid=739c0ec2-796e-51ea-28d8-1082e2b08093 srccity=Reserved srcgeoid=1000000000 dstgeoid=6252001 dcgeo=US usecase=Conversational_Assistant devid=FG200FTXXXX vd=root dtime=2026-03-20 13:50:52
The Forward Traffic logs operate differently from Application Control logs.
Forward Traffic logs aggregate results from multiple modules configured in the firewall policy and may record sessions after they have ended, whereas Application Control logs are usually generated based on the initial connection phase.
In Application Control logs, a single session may match multiple signatures and generate multiple entries. In contrast, the Forward Traffic log selects only one of these matches and generates its own entry accordingly.
For analysis related to application signatures, it is recommend using Application Control logs as the primary reference, as they provide more accurate information and real-time source for validating detection results.
Entries could be correlated between Forward Traffic logs and Application Control log using the session ID. | 
