So after 137 days of being up, i rebooted the system and changed the logging to;
syslog {
archive size 100k files 3;
user * {
any emergency;
}
host [IP] {
any emergency;
authorization any;
user any;
}
file messages {
any notice;
authorization info;
match "!(.RT_FLOW_SESSION_CREATE.*)";
}
file interactive-commands {
interactive-commands info;
match UI_CMDLINE_READ_LINE;
}
file blocked-traffic {
any any;
match RT_FLOW_SESSION_DENY;
}
}
It is not showing a lot of level 7 messages (debug) which is distratcing, but the messages related to AppFlow have stopped.
Unfortunately, i have no idea why it has done it.. and im not sure if changing the syslogging has just masked the problem...