A network engineer notices that a high-volume policy carrying routine telemetry between two internal utility segments has its logging option set to disable logging entirely, to keep log storage manageable. During a later incident investigation, the SOC needs to reconstruct exactly which internal hosts communicated across that policy during a specific hour, but the traffic log has no relevant entries. What is the best explanation, and the trade-off it represents?
Select an answer to reveal the explanation.
Short Explanation
'No log' means exactly that — nothing gets written for that policy's sessions, full stop. It's a deliberate trade: less log noise and storage pressure now, but a permanent blind spot if you ever need those records later.
Full Explanation
Setting a firewall policy's logging option to disabled turns off traffic log generation for every session that policy handles; unlike the 'log security events only' setting, which still logs profile-triggered events, disabling logging entirely removes the policy from the traffic log altogether, with no separate mechanism silently capturing the data elsewhere. This is a legitimate, deliberate configuration choice for extremely high-volume internal flows where the storage and performance cost of full logging outweighs its value, but it comes with a real cost: once traffic has passed unlogged, there is no way to reconstruct it after the fact, because the record was never written in the first place. The claim that FortiOS retains 30 days of session data independent of a policy's logging setting is incorrect, logging happens (or doesn't) at the point a policy processes a session, and there is no separate always-on shadow log to fall back on. Assuming the missing entries mean the traffic never traversed the policy confuses cause and effect; the traffic could easily have flowed exactly as expected and simply never been recorded, which is the whole point of disabling logging. There is also no hidden log-view filter to adjust here, if nothing was written, there is nothing a filter can surface. The practical lesson for the SOC is to weigh forensic need against log volume before disabling logging on any policy that might ever matter to an investigation, and to verify a policy's actual logging setting directly in its configuration rather than assuming records exist somewhere.