156-215.81 · Question #621
How do logs change when the "Accounting" tracking option is enabled on a traffic rule?
The correct answer is C. Involved traffic logs are updated every 10 minutes to show how much data has passed on the. Accounting - Select this to update the log at 10 minutes intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitorin…
Question
How do logs change when the "Accounting" tracking option is enabled on a traffic rule?
Options
- AInvolved traffic logs will be forwarded to a log server.
- BProvides log details view email to the Administrator.
- CInvolved traffic logs are updated every 10 minutes to show how much data has passed on the
- DProvides additional information to the connected user.
How the community answered
(29 responses)- A7% (2)
- B3% (1)
- C76% (22)
- D14% (4)
Explanation
Accounting - Select this to update the log at 10 minutes intervals, to show how much data has passed in the connection: Upload bytes, Download bytes, and browse time. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitorin g_AdminGuide/Topics-LMG/Tracking-Options.htm
Topics
Community Discussion
9
Anjali D.Jan 10, 2026The correct answer is C. When you enable Accounting as the tracking option on a rule in Check Point, the firewall generates periodic log updates for active connections every 10 minutes, showing how much data has passed through that connection over time. This is different from a standard Log entry, which just captures the initial connection, because Accounting keeps refreshing the record so you get a running picture of traffic volume on long-lived sessions. Options A and D describe behaviors tied to logging and user notification settings that are unrelated to what Accounting specifically does, and B is just not a real Check Point feature in this context. Our group flagged this one as a tricky wording question because people confuse Accounting with Alert or other tracking modes, so the 10-minute interval detail is the thing to lock in your memory. Anyone else have a different take or a resource that explains the interval behavior more clearly?
Brenda K.Jan 11, 2026Anjali nailed the core of it, but lock in one more layer for test day: that 10-minute interval is the default, and the exam has been known to probe whether you know it is configurable, so do not let "10 minutes" calcify as a fixed constant in your head.
Fatima Z.Dec 30, 2025Okay real talk, I jumped straight to A because my brain screamed "accounting equals reporting equals send it somewhere," and a log server felt like the logical destination, so I circled A without even blinking. But then I pictured the word ACCOUNTING like an actual accountant at a desk, and what does an accountant do, they tally up running totals on a ledger every few minutes, not ship the ledger to another office. That image locked in C for me, because Accounting tracking in Check Point literally updates the existing log entry every 10 minutes with a fresh byte count, showing you how much data has flowed through that connection over time. My hook to keep this straight is the word ACE, Accounting Counts Every-ten-minutes, and once that stuck I stopped second-guessing myself on this one.
Samuel O.Jan 1, 2026The ACE hook is solid, just make sure you remember that the 10-minute update is also triggered by a session end, so the final tally gets written even if the connection closes at minute 3.
Brenda K.Dec 23, 2025Clock yourself on this one, it is a fast read but A will eat your time if you let it. A sounds right because of course logs go to a log server, but that describes the general logging behavior, not what Accounting specifically adds. Accounting is the session-volume counter, it updates the traffic log entry on an interval to reflect cumulative bytes passed on the connection, and the 10-minute refresh cycle is the testable detail Check Point actually wants you to nail. B and D are noise, discard them in under five seconds. C is your answer, bank the time and move on.
Samuel O.Jan 2, 2026B, seen it firsthand, admin gets that log detail email every time.
Fatima Z.Jan 3, 2026Hey Samuel, the correct answer is C on this one, because that log detail goes to the security audit trail, not an admin email notification. Mind sharing the full question so I can drop a memory hook that makes C stick for everyone?
Ola B.Jan 19, 2026Spun up a lab on this exact scenario last week and watched the SmartLog output in real time. When you flip Accounting on for a rule, the gateway starts shipping those connection logs out to your log server, plain and simple, which is exactly what A describes. The other options talk about email alerts and per-user messaging, which belong to different features entirely, and the 10-minute update in C sounds like someone mixed up Accounting with the session rate logging behavior, which is a different animal. Go with A.
Fatima Z.Jan 21, 2026Good catch on the lab work, Ola, but the trick here is the mnemonic ACE, where Accounting equals a Connection update Every 10 minutes on active sessions, which is exactly what C describes. Option A describes standard connection logging, not the periodic Accounting heartbeat that keeps ticking mid-session.