Logging for trusted connections

Logging for trusted connections is a system capability that

  • records the beginnings and ends of trusted connections for traffic matching access control rules with Trust action

  • captures events for traffic matching the access control default action Trust All Traffic, and

  • generates limited information because trusted connections are not subject to deep inspection or discovery.

Trusted connection logging behavior

You can log the beginnings and ends of trusted connections, which includes traffic matching these rules and actions:

  • Access control rules: Trust action

  • Access control default action: Trust All Traffic

Note

Although you can log trusted connections, we recommend you do not do so because trusted connections are not subject to deep inspection or discovery, so connection events for trusted connections contain limited information.

TCP connections detected by a Trust rule on the first packet generate only an end-of-connection event. The system generates the event one hour after the final session packet.