Clarification of "Log action messages 'Accept: session close' and 'Accept: session timeout' "

Hi! 

I’m seeking clarification of KB 96255. I read it as that there are two different types of triggers for a session drop due to idle-timeout - (a) for a session in TCP Established state - resulting in log message with “action=close”; and (b) TCP session in an embryonic state resulting in log message with “action=timeout”.

However, this contradicts my experience - for Log message logid=0000000013 with “duration=4376”, “rcvdbyte=64713”, “sentbyte=29953” (ie. not an embryonic session) I see “action=timeout”, implying timeout due to trigger (a), not (b). That is, the opposite of what the KB documents, (albeit, I am assuming it’s referring to Log message logid=0000000013).

Anyone can vouch for veracity of the KB, and if so, explain why I’m seeing a log message with “action=timeout” for non-embryonic session?

Thanks!