In some SRX deployments, security policies configured with action "deny" and logging option "log session-init" may generate both RT_FLOW_SESSION_DENY and RT_FLOW_SESSION_CREATE log messages for the same traffic flow.

This behavior can appear as if a session was created even though the security policy correctly denied the traffic. The observed RT_FLOW_SESSION_CREATE messages are logging artifacts and do not indicate that packets were forwarded through the firewall.

- Duplicate log entries are observed for denied traffic.
- RT_FLOW_SESSION_CREATE logs appear even though the traffic is denied.
- No packets are forwarded through the firewall.
- Logging output may appear misleading during log review.

Log Sequence:

1. RT_FLOW_SESSION_DENY is generated indicating the session was denied by policy.

2. RT_FLOW_SESSION_CREATE is generated immediately afterward for the same flow.

3. Despite the create log, the session is not permitted and no traffic is forwarded.

This behavior has been identified as an SRX logging behavior when "log session-init" is enabled on deny policies. The RT_FLOW_SESSION_CREATE logs are duplicate log entries and do not indicate that the traffic was permitted.

Recommendation is to use "log session-close" instead of "log session-init" on the deny policy. JTAC testing confirmed that "log session-close" provides stable and expected logging behavior for denied sessions.