Srx chat no logging in
You can configure a policy so that traffic information is logged when a session begins (session-init) and/or closes (session-close).
To generate traffic logs for multiple policies, you must configure each policy to log traffic information.
Therefore, all traffic logging must be sent to a remote syslog server.
SRX Series devices can send system log messages from the control plane (Routing Engine) to one or more destinations.
The configuration has been described at section 1.1 Services on the control plane: Data plane logs are primarily those generated by components that process traffic on the data plane.
These include the firewall logs (RT_LOG, which stands for Real-Time Log because it is not stored on the data plane) from the flowd process, IPS logs, UTM logs, and logs from other security components like Screens.
Control plane logging is on by default to log locally, but you can override this with your own logfiles, syslog hosts, and criteria for different log messages.
All logs are stored in the /var/log directory on the control plane.