Netflow Session Logs

This section describes the mechanism for the FW to output customized netflow session logs to a third-party log host.

Context

Netflow session logs in the default format have fixed content that cannot be modified. To define the fields in the log content and the location and sequence of each field, configure the netflow session log template format to customize the log content. After the configuration is complete, the FW sends the user-defined netflow session log content to the third-party log host.

The following types of netflow session logs can be customized:

IPv4 session logs
Logs generated by session aging, session creation, and periodic sessions can be customized.
IPv6 common session logs
Logs generated by session aging and session creation can be customized.
IPv6 NAT64 session logs
Logs generated by session aging and session creation can be customized.

Before the configuration, you need to understand the contents of the log fields negotiated with the third-party log host. Only the third-party log host that can parse the customized netflow session log format can view the log contents.