HTTP/2 Connection and Stream Session Logging
Learn about the HTTP/2 session logging.
Overview
In HTTP/2, a single TCP connection session multiplexes multiple HTTP stream sessions. Each stream is established, processed, and closed independently within the same connection.
This feature improves HTTP/2 logging by separating stream session logs from connection session logs while preserving existing connection session behavior. The system generates dedicated log types for stream sessions, enabling visibility at the stream level without affecting connection session logging.
Traffic accounting aligns with HTTP/2 semantics. Stream sessions use frame-based metrics instead of packet-based metrics, and HTTP/2 frame sizes for byte accounting. This approach ensures accurate session counts and consistent traffic reporting.
Connection and stream sessions are linked using explicit identifiers such as connection session ID and stream session IDs, simplifying correlation and analysis. Connection sessions continue to use existing session log types, ensuring compatibility with current log parsers.
Configuration
By default, HTTP/2 connection sessions do not generate session logs. You can configure the following configuration statements to enable session initialization and closure logs for HTTP/2 connection sessions:
set security policies default-http-mux-policy then log session-init set security policies default-http-mux-policy then log session-close
Benefits of HTTP/2 Connection and Stream Session Logging
-
Accurate accounting — Prevents double counting by separating connection and stream session logs.
- Consistent metrics — Uses frame-based counters aligned with HTTP/2 behavior.
- Improved troubleshooting — Provides visibility into individual streams.
- Flexible logging — Allows independent control of connection and stream session logging.
Logging Enhancements
-
Separate stream log types — HTTP stream sessions generate dedicated
RT_FLOW_STREAM_*logs, preventing overlap with connection-level logs. -
Frame-based metrics — Stream session logs uses
frames-from-clientandframes-from-servercounters. -
Accurate byte accounting — Reports HTTP/2 frame size in byte counters (
bytes-from-clientandbytes-from-server). -
Field clarity — Connection sessions use
nested-application="N/A"; stream sessions include application and stream identifiers.
Difference Between Connection and Stream Sessions
| Attribute | HTTP Connection Session | HTTP Stream Session |
| Log type | RT_FLOW_SESSION_* |
RT_FLOW_STREAM_* |
| Representation | TCP/TLS connection | HTTP/2 stream |
| Application | HTTP2 |
HTTP or specific application |
| Identification field | Not present | parent-session-id |
| Stream identifiers | Not applicable | client-side-stream-id,
server-side-stream-id |
| nested-application | N/A |
Application name |
| Metrics | Packets and bytes | Frames and bytes |
Example HTTP/2 Session Logs
The following examples show representative RT_FLOW logs for HTTP/2 connection and stream sessions, including create, close, and deny events:
HTTP Stream Session Logs
Stream create: 2023-05-19T18:20:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_STREAM_CREATE [junos@2636.1.1.1.2.35 source-address=”192.168.1.101” source-port=”33883” destination-address=”192.168.2.101” destination-port=”443” service-name=”junos-https” nat-source-address=”192.168.1.101” nat-source-port=”33883” nat-destination-address=”192.168.2.101” nat-destination-port=”80” src-nat-rule-name=”None” dst-nat-rule-name=”None” protocol-id=”6” policy-name=”sec_policy” source-zone-name=”trust” destination-zone-name=”untrust” session-id-32=”80000059” username=”N/A” roles=”N/A” packet-incoming-interface=”ge-0/0/1.0” application=”HTTP” nested-application=”facebook” encrypted=”no” conn-tag=”0” parent-session-id=”80000058” client-side-stream-id=”102” server-side-stream-id=”102”]
Stream close: 2023-05-19T18:25:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_STREAM_CLOSE [junos@2636.1.1.1.2.35 reason="TCP FIN" source-address=”192.168.1.101” source-port=”33883” destination-address=”192.168.2.101” destination-port=”443” service-name=”junos-https” nat-source-address=”192.168.1.101” nat-source-port=”33883” nat-destination-address=”192.168.2.101” nat-destination-port=”80” src-nat-rule-name=”None” dst-nat-rule-name=”None” protocol-id=”6” policy-name=”sec_policy” source-zone-name=”trust” destination-zone-name=”untrust” session-id-32=”80000059” username=”N/A” roles=”N/A” frames-from-client="2" bytes-from-client="356" frames-from-server="247" bytes-from-server="247145" elapsed-time="213" application=”HTTP” nested-application=”facebook” username="N/A" roles="N/A" packet-incoming-interface=”ge-0/0/1.0” encrypted=”no” conn-tag=”0” parent-session-id=”80000058” client-side-stream-id=”102” server-side-stream-id=”102”]
stream deny: 2023-05-19T18:20:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_STREAM_DENY [junos@2636.1.1.1.2.35 source-address="192.168.1.101" source-port="33883" destination-address="192.168.2.101" destination-port="443" service-name="junos-https" protocol-id="6" policy-name="sec_policy" source-zone-name="trust" destination-zone-name="untrust" session-id-32="80000059" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" application="HTTP" nested-application="facebook" conn-tag="0" parent-session-id="80000058" client-side-stream-id="102" server-side-stream-id="102"]
HTTP Connection Session Logs
Stream create: 2023-05-19T18:20:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.35 source-address="192.168.1.101" source-port="33883" destination-address="192.168.2.101" destination-port="443" service-name="junos-https" nat-source-address="192.168.1.101" nat-source-port="33883" nat-destination-address="192.168.2.101" nat-destination-port="80" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="sec_policy" source-zone-name="trust" destination-zone-name="untrust" session-id-32="80000058" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" application="HTTP2" nested-application="N/A" encrypted="yes" conn-tag="0"]
Stream close: 2023-05-19T18:25:37.630+08:00 flow-srx4600-01 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.35 reason="TCP FIN" source-address="192.168.1.101" source-port="33883" destination-address="192.168.2.101" destination-port="443" service-name="junos-https" nat-source-address="192.168.1.101" nat-source-port="33883" nat-destination-address="192.168.2.101" nat-destination-port="80" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="sec_policy" source-zone-name="trust" destination-zone-name="untrust" session-id-32="80000058" username="N/A" roles="N/A" packets-from-client="10" bytes-from-client="4356" packets-from-server="2470" bytes-from-server="2471450" elapsed-time="213" packet-incoming-interface="ge-0/0/1.0" application="HTTP2" nested-application="N/A" encrypted="yes" conn-tag="0"]