This article explains an issue where security logging for a deny rule generates 3 different event logs.

If security logging is enabled on a deny rule for both session init and session close events, SRX will generate 3 security logs for each packet hitting this deny security rule as shown below:

May 23 07:07:39 xx.xx.xx.xx 1 2025-05-23T07:07:38.519+03:00 01PFW01 RT_FLOW - RT_FLOW_SESSION_CLOSE reason="drop flow" source-address="xx.xx.xx.xx" source-port="47692" destination-address="xx.xx.xx.xx" destination-port="3389" connection-tag="0" service-name="junos-rdp" nat-source-address="0.0.0.0" nat-source-port="0" nat-destination-address="xx.xx.xx.xx" nat-destination-port="3389" nat-connection-tag="0" src-nat-rule-type="N/A" src-nat-rule-name="N/A" dst-nat-rule-type="destination rule" dst-nat-rule-name="r17" protocol-id="6" policy-name="ABC" source-zone-name="Untrust" destination-zone-name="DMZ" session-id="4301632632" packets-from-client="1" bytes-from-client="40" packets-from-server="0" bytes-from-server="0" elapsed-time="4" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth0.235" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="-1" application-characteristics="N/A" secure-web-proxy-session-type="NA" peer-session-id="0" peer-source-address="0.0.0.0" peer-source-port="0" peer-destination-address="0.0.0.0" peer-destination-port="0" hostname="NA NA" src-vrf-grp="N/A" dst-vrf-grp="N/A" tunnel-inspection="Off" tunnel-inspection-policy-set="root" session-flag="0" source-tenant="N/A" destination-service="N/A" user-type="N/A" dst-identity-context-name="N/A" dst-identity-context-roles="N/A"]

action = teardowndest_ip = xx.xx.xx.xxhost = xx.xx.xx.xxsrc_ip = xx.xx.xx.xx

5/23/25

7:07:35.000 AM

May 23 07:07:35 xx.xx.xx.xx 1 2025-05-23T07:07:35.367+03:00 01PFW01 RT_FLOW - RT_FLOW_SESSION_CREATE source-address="xx.xx.xx.xx" source-port="47692" destination-address="xx.xx.xx.xx" destination-port="3389" connection-tag="0" service-name="junos-rdp" nat-source-address="0.0.0.0" nat-source-port="0" nat-destination-address="xx.xx.xx.xx" nat-destination-port="3389" nat-connection-tag="0" src-nat-rule-type="N/A" src-nat-rule-name="N/A" dst-nat-rule-type="destination rule" dst-nat-rule-name="r17" protocol-id="6" policy-name="ABC" source-zone-name="Untrust" destination-zone-name="DMZ" session-id="4301632632" username="N/A" roles="N/A" packet-incoming-interface="reth0.235" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="-1" application-characteristics="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A" tunnel-inspection="Off" tunnel-inspection-policy-set="root" source-tenant="N/A" destination-service="N/A" dst-identity-context-name="N/A" dst-identity-context-roles="N/A"]

action = alloweddest_ip = xx.xx.xx.xxhost = xx.xx.xx.xxsrc_ip = xx.xx.xx.xx

5/23/25

7:07:35.000 AM

May 23 07:07:35 xx.xx.xx.xx 1 2025-05-23T07:07:35.367+03:00 01PFW01 RT_FLOW - RT_FLOW_SESSION_DENY [source-address="xx.xx.xx.xx" source-port="47692" destination-address="xx.xx.xx.xx" destination-port="3389" connection-tag="0" service-name="junos-rdp" protocol-id="6" icmp-type="0" policy-name="ABC" source-zone-name="Untrust" destination-zone-name="DMZ" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth0.235" encrypted="No" reason="Denied by policy" session-id="4301632632" application-category="N/A" application-sub-category="N/A" application-risk="-1" application-characteristics="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A" source-tenant="N/A" destination-service="N/A" user-type="N/A" dst-identity-context-name="N/A" dst-identity-context-roles="N/A" source-country="N/A" destination-country="N/A"]

action = blockeddest_ip = xx.xx.xx.xxhost = xx.xx.xx.xxsrc_ip = xx.xx.xx.xx

This is an expected behaviour, as the SRX creates a drop-flow with default timeout value of 4 Seconds whenever the session is denied by a security rule. It will generate 3 different logs per packet as, RT_FLOW_SESSION_DENY, RT_FLOW_SESSION_CREATE and RT_FLOW_SESSION_CLOSE.