This is a solution for security logs not being generated.

• Security log generation is configured in one way or another (security policies, IDP, etc), example:

set security policies from zone trust to zone untrust policy permit-all then log session-init

• If configured as event mode, even when configuring a file under "system log" hierarchy as "any any" the file does not fill with security logs.

• If configured as stream logs, the stream files do not fill, and the stream host do not even generate any syslog packets, which can be demonstrated with "monitor traffic" command.

If all symptoms match, there's an issue with the "rtlogd" daemon (security-log daemon).

Restart the daemon with "restart security-log" if, after running the command you get the following output "warning: security-log subsystem has been disabled by the user", it means the daemon was disabled in the config, specifically the "system processes" deleting the "disable" command will make the daemon come back up and fix the issue.