Consensus for Firewall Policy Logging

[johnlloyd_13]

hi,

we have FG-xx "F" in our environment

my question is, since these FG have internal HDD

1. is it "safe" to enable log "all sessions"?

2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?

3. is there a default threshold or buffer size in the HDD by these "F" models?

is there also a "preferred" FW policy sequence based on its specific purpose/criteria? this is to prevent an overlap or "shadow" FW policy. refer sample below

1. DNAT using VIP

2. SNAT using IP pool

3. SNAT using Egress interface