If the device suffers from heavy traffic, its performance degrades dramatically. The login to the console is delayed or fails. More seriously, the device is suspended, the access to the Internet is slow, or even interrupted.

Besides abnormalities caused by attacks such as DoS/DDoS, other kinds of issues will be easily ignored:

The Network Secure enables the logging function of the application control policy or the traffic audit logs. The disk frequently reads and writes data, causing high usage of the I/O and CPU, and even corruption in the disk. It is strongly recommended to record these logs in the external data center or Syslog server rather than the built-in data center.

The logs of the application control policy are shown in the following figure, in which the Yes in the Logs column means to record logs:

The Traffic Audit Logs option is as shown below (Disable it normally). If you need to enable it, select the Syslog (Recommended) or Cyber Command for the logging location. It is not recommended to record logs in the firewall.