Log At Session Start
consumes more resources than logging only at the session end. In
most cases, you only
Log At Session End
.
Enable both
Log At Session Start
and
Log At Session End
only for
troubleshooting, for long-lived tunnel sessions such as GRE tunnels
(you can't see these sessions in the ACC unless you log at the start
of the session), and to gain visibility into Operational
Technology/Industrial Control Systems (OT/ICS) sessions, which are
also long-lived sessions.