Palo Alto Session Logging: Log at Start vs End

Palo Alto Networks firewalls can log a session at its start, at its end, or both. The setting that controls this is the Log at Session Start checkbox on a security policy rule, and the choice matters because it determines whether you see a session immediately when it begins or only after it closes. In short: log at start if you need real-time visibility into active sessions, log at end (the default) if you want the complete session record with byte counts and duration.

Formula

The calculator above works out the average throughput of a session given its duration and total bytes. The formula is:

Average throughput (MB/min) = Total bytes (MB) ÷ Session duration (min)

For Mbps, convert megabytes to megabits (multiply by 8) and minutes to seconds (multiply by 60):

Average throughput (Mbps) = (Total bytes × 8) ÷ (Session duration × 60)

• t = session duration in minutes (from the firewall’s session end log, which records how long the session lasted)
• bytes = total bytes transferred in the session, in megabytes (from the end-of-session log’s bytes_sent + bytes_received fields)

This is useful when you’re comparing the size of start vs end logs: end logs carry this data, start logs do not.

Worked Example

Using the defaults: a session lasted 5 minutes and transferred 100 MB.

1. Throughput in MB/min: 100 ÷ 5 = 20 MB/min
2. Throughput in Mbps: (100 × 8) ÷ (5 × 60) = 800 ÷ 300 = 2.67 Mbps

The calculator shows 20.00 MB/min and 2.67 Mbps for these values.

Why the Default Is Log at End

Palo Alto firewalls, by default, log a session when it ends. This is the behavior you get out of the box on any security policy rule unless you explicitly check Log at Session Start. The reason is simple: an end-of-session log contains the complete picture of that session—total bytes sent and received, session duration, the reason the session closed, and the total packets. A start log only captures the moment the session was initiated: source and destination IPs, ports, application, user, and the initial action (allow or deny).

For most security monitoring and reporting, the end log is what you want. It’s the definitive record. If you log only at start, you lose the byte counts and duration, which makes bandwidth reporting and data usage analysis impossible. You also miss sessions that were denied at the start—those never produce an end log because they never became a session.

When to Enable Log at Session Start

There are legitimate reasons to enable start logging on specific rules. The most common is real-time alerting. If you have a rule that allows access to a sensitive server or a high-risk application, you might want to see the session as soon as it begins, not minutes or hours later when it ends. A start log gives you immediate visibility into who is connecting to what, right now.

Another use case is troubleshooting connectivity. When a user reports that an application is slow or failing, a start log confirms that the firewall saw the connection attempt and allowed it. End logs only appear after the session closes, which could be a long time after the user’s complaint.

However, enabling start logging on every rule is generally discouraged. It doubles the log volume for long-lived sessions (one at start, one at end), which increases storage consumption and can degrade Panorama or log collector performance. A balanced approach is to enable start logging only on rules that match high-value assets or specific threat-detection use cases, and leave the rest at end-only.

How the Two Log Types Differ in Content

The actual fields in a Palo Alto session log differ depending on whether it’s a start or end log. A start log includes:

• Time generated (when the session started)
• Source and destination IP, port, and user
• Application identified (may be incomplete at start)
• Action taken (allow, deny, drop)
• Rule that matched

An end log includes all of the above, plus:

• Session duration
• Total bytes sent and received
• Total packets sent and received
• Session end reason (tcp-fin, tcp-rst, age-out, etc.)
• NAT source and destination (post-NAT IPs)

Notably, the application field in a start log may show as “incomplete” or “not-applicable” because the firewall may not have identified the application yet at the moment the session begins. The end log has the final, accurate application identification.

Common Misconception: Start Logs Are More Secure

A frequent belief is that logging at session start is somehow more secure because you see every connection attempt immediately. In practice, the security value of a start log is limited. A session that is allowed and then transfers malicious content will only be flagged by threat prevention at the moment the threat is detected, which is a separate log entry (a threat log), not a session log. The session log at start tells you a connection was made; the end log tells you what that connection actually did. For forensic investigation after an incident, end logs are far more valuable because they contain the full byte counts and duration that correlate with threat logs.

Another misconception is that if you don’t log at start, you miss denied traffic. That’s false. Denied sessions are logged at the moment of denial, regardless of the start/end setting, because there is no “end” to a session that never started. The deny log appears immediately in the traffic log.

Performance and Storage Considerations

Every session log entry consumes storage on the firewall’s local disk or on a Panorama log collector. Enabling start logging effectively doubles the number of session log entries for long-lived sessions, because you get one at start and one at end. For a firewall handling tens of thousands of sessions per second, this can significantly increase log storage requirements and may lead to earlier log rotation or loss of older logs.

There is also a slight performance impact on the management plane, since each log write involves processing. On high-throughput firewalls, the dataplane forwards session information to the management plane for logging; more logs mean more work. In practice, the impact is small on modern hardware, but it’s not zero. If you have a very high session rate, consider whether the real-time visibility is worth the extra load.

How to Configure It

The setting is per security policy rule, not global. To change it:

1. Go to Policies → Security and select the rule you want to modify.
2. Click the Actions tab.
3. Under Logging, check or uncheck Log at Session Start.
4. Click OK and commit the change.

Note that the checkbox only affects that specific rule. If you want start logging for all rules, you must enable it on each rule individually. There is no global toggle. Also, the setting applies only to sessions that match the rule; if a session matches a different rule, that rule’s logging setting applies.

Frequently Asked Questions

Does logging at session start affect the session itself? No. Logging is a passive action; it does not change how the session is handled. The firewall still allows or denies based on the rule’s action, and the session proceeds normally.

Can I have both start and end logs for the same session? Yes. If you check “Log at Session Start,” the firewall writes a start log and also writes an end log when the session closes. You’ll see two entries with the same session ID in the traffic log.

Why do I see “incomplete” as the application in start logs? At the moment a session starts, the firewall may not have identified the application yet. Application identification happens after a few packets are inspected. The end log will have the final application.

Does the start/end setting apply to denied traffic? Denied sessions are logged immediately at the time of denial, regardless of the setting, because there is no session to end. So you always see denied traffic in the log.

Should I enable start logging on all rules for better visibility? Not recommended. It doubles log volume for long sessions and provides limited additional security value. Enable it selectively on rules that match critical assets or where real-time alerting is needed.

Related

• AI Unit Economics: A CIO’s Guide to Scaling
• Dandy’s World Toons Tier List and Team Strategy
• How to Sell or Trade In Used Electronics Safely

in t | Session duration | min | 5 | 0 | 1440
in bytes | Total bytes transferred | MB | 100 | 0 | 1000000
out rate | Average throughput | MB/min | bytes / t | 2
out rate_mbps | Average throughput | Mbps | (bytes * 8) / (t * 60) | 2