Here's the firewall policy in question.
And in this simple log you will see a message with the "start" and "close". This reflects the start of the session and closure for sessionid 899 for a curl ifconfig.co from my host computer
So at the conclusion, the firewall will log the sent/recv details and duration for the session. The start action is initialized upon the start.
NOTE: without logtraffic-start the default behavior is to log when the session closes
NSE ( network security expert) and Route/Switching Engineer
kfelix -----a----t---- socpuppets ---dot---com
=( @ @ )=