packet process

The  diag debug flow command should show you that also for most UTMs features.

Ken

The syntax is usually:

id=13 trace_id=1 func=fw_forward_handler line=664 msg="Allowed by Policy-1: AV SNAT"

id=13 trace_id=1 func=av_receive line=255 msg="send to application layer"

-or-

id=13 trace_id=3349 func=fw_forward_handler line=664 msg="Allowed by Policy-24: SNAT" id=13 trace_id=3349 func=ids_receive line=237 msg="send to ips"

SNAT/DNAT may or may not be present, signifying that NAT is being applied to the traffic.

For UTM, we use AV and 'application layer' as shorthand for proxy-based UTM, and 'send to ips' for flow-based inspection.

They don't necessarily mean that AV or IPS are specifically enabled for any one policy. In my case, this output was generated using a proxy-based webfilter profile, and indeed an IPS sensor for the second example.