Log sources for 5GC — NF logs, NGAP, PFCP, flow

Five Log Categories for 5GC

A 5GC SOC depends on five major log categories. NF access/operational logs: each NF emits per-call logs (timestamp, source NF identity, service called, operation, status code, response time). These are the primary SBI visibility — they show who called what, when, and whether it succeeded. NGAP signaling logs: NGAP messages between AMF and gNB. AMF and gNB logs capture registration, mobility, paging, and other NGAP events. Critical for RAN-side attack detection. PFCP logs: PFCP messages between SMF and UPF (and between UPF instances). SMF and UPF logs capture session establishment,…