You want to enable local logging for security policies and have the log information stored in a
separate file on a branch SRX Series device. 
Which configuration will accomplish this task?
A.
[edit system syslog] 
user@host# show 
file sec-pol-log { 
user info; 
}
B.
[edit system syslog] 
user@host# show 
host 192.168.1.1 { 
user info; 
}
C.
[edit system syslog] 
user@host# show 
file sec-pol-log { 
any any; 
}
D.
[edit system syslog] 
user@host# show 
file sec-pol-log { 
security info; 
}
shouldn’t it be C?
C is the correct, juniper KB states clearly to set it to any any, however a more advanced is to match on “RT_FLOW_SESSION” otherwise it will log anything to the log which is not that great.
Answer should be “C”
http://kb.juniper.net/InfoCenter/index?page=content&id=KB16509