So after a bit of digging, it appears I have to use the "Firewall Action" log template ( and then changing the log level to inform, I can see all times that policies are hit and which ones … (View Post)