PCNSE · Question #623
As a best practice, logging at session start should be used in which case?
The correct answer is A. While troubleshooting. Session-start logging creates a log entry the moment a session opens, then another when it closes, effectively doubling log volume and storage load. This overhead is only justified during active troubleshooting - for example, when you need to confirm that a long-lived session…
Question
As a best practice, logging at session start should be used in which case?
Options
- AWhile troubleshooting
- BOnly on Deny rules
- COnly when log at session end is enabled
- DOn all Allow rules
How the community answered
(36 responses)- A94% (34)
- C3% (1)
- D3% (1)
Explanation
Session-start logging creates a log entry the moment a session opens, then another when it closes, effectively doubling log volume and storage load. This overhead is only justified during active troubleshooting - for example, when you need to confirm that a long-lived session was seen before it terminates. Best practice is to leave session-start logging disabled in production and enable it only while diagnosing a specific issue.
Topics
Community Discussion
No community discussion yet for this question.