Some of FW capabilities are very useful for debugging APPs behavior via logging by creating additional policies.
In order to make the most out of this great by product some additional info would be great :
DNS full request itype (i.e. A,C,NS,SOA,PTR, etc.) + argument.
SMTP (mail) protocol (IMAP, POP3, etc.) and arguments (server name - not just ip and request)
HTTP / HTTPS / FTP : target name (not just ip), request type (GET / PUT / etc.) and path (URL).
When logging target names it’s best if those are fetched from original request and not via reverse lookup.
In order to lower performance impact (although fetching from orig request and not via reverse lookup will reduce such impact anyway) to minimal : such additional info is to be fetched / addressed only for (when) logging - thus even implementation is likely to be rather simple …
