Technical Tip: Difference between 'Security Events' and 'All session' in Log Allowed Traffic in Firewall Policy

[hrahuman_FTNT]

Description	This article describes the difference between 'Security Events' and 'All session' in Log Allowed Traffic in Firewall Policy.
Scope	FortiGate.
Solution	Log 'Security Events' will only log Security (UTM) events (e.g. AV, IPS, firewall web filter), providing one of them has been applied to a firewall (rule) policy. 'Log all sessions' will include traffic log include both match and non-match UTM profile defined. To edit the firewall policy logging in the web GUI: To edit the firewall policy logging on the CLI: config firewall policy     edit 1        set logtraffic {all | utm | disable}     next end all Log all sessions accepted or denied by this policy. utm Log traffic that has a security profile applied to it. disable Disable all logging for this policy.