Cisco ASA

Source: ASA syslog messages 302003–342008. Cisco documents the message format with placeholders rather than a filled example. These are the connection build and teardown formats — the highest-volume ASA messages — quoted as printed.

%ASA-6-302013: Built {inbound | outbound} TCP connection connection_id for interface:real-address/real-port (mapped-address/mapped-port) to interface:real-address/real-port (mapped-address/mapped-port)
%ASA-6-302014: Teardown TCP connection connection_id for interface:real_address/real_port to interface:real_address/real_port duration hh:mm:ss bytes bytes
%ASA-6-302015: Built {inbound | outbound} UDP connection connection_id for interface:real_address/real_port (mapped_address/mapped_port) to interface:real_address/real_port (mapped_address/mapped_port)
%ASA-6-302016: Teardown UDP connection connection_id for interface:real_address/real_port to interface:real_address/real_port duration hh:mm:ss bytes bytes

ASA writes 302013/302015 at connection setup and 302014/302016 at teardown, so the session-start lever applies.