OK, I haven't found any more information on the cache setting, but it looks like the new "report" security/log configuration setting added in 15.x-d100 allows you to store all of the dataplane logs on the local box while in stream mode. It also allows you to create reports and graphs in jweb using the data or access the data right from the CLI using show security log report in-detail all and similar commands. There are a lot of options for parsing/displaying the information in the CLI. If you want to be able to view dataplane (security) logs on the firewall while running in stream mode, this may be just what you are looking for.
↧