Monitoring, Logging and Reporting
Telemetry types
NGFWs generate traffic, threat, system, configuration, and audit logs. Forward via syslog (UDP/TCP/TLS), SNMP traps for events, SNMP polling for counters, and NetFlow/IPFIX for flow analytics. Local storage has quotas; when full, the oldest logs are overwritten or logging stops depending on configuration.
Time and correlation
NTP is mandatory-skewed clocks break correlation across firewall, SIEM, and endpoints. Use consistent time zones and UTC in exports. Severity levels (emergency through debug) and log forwarding profiles decide what leaves the device.
Traps
Threat logs not forwarded because the profile lacks a forwarding action, session-end logging delays (long-lived sessions log only at close), and SNMP community string or version mismatches. Also watch log-rate limiting that silently drops events under load.
Rule of thumb
For any 'traffic blocked' ticket: check interface counters, then session table, then traffic log, then threat log, then policy hit count. The first three usually identify the layer.
Worked example
A SIEM shows no threat events from one firewall while traffic logs arrive: the threat log forwarding profile is attached to the security policy but the syslog server is configured only under a different log type. Align forwarding profiles per log type.