Issue
There is no logging in an unlicensed VM-Series firewall.
Resolution
PAN-OS 7.0 = An unlicensed VM-Series firewall can process up to 200 concurrent sessions. Depending on the environment, the session limit can be reached very quickly. Therefore, apply the capacity auth-code and retrieve a license before you begin testing the VM-Series firewall; otherwise, you might have unpredictable results, if there is other traffic on the port group(s).
PAN-OS 7.1 = An unlicensed VM-Series firewall can process up to approximately 1245 concurrent sessions. Depending on the environment, the session limit can be reached very quickly. Therefore, apply the capacity auth-code and retrieve a license before you begin testing the VM-Series firewall; otherwise, you might have unpredictable results, if there is other traffic on the port group(s).
PAN-OS 8.0 = An unlicensed VM-Series firewall can process up to approximately 1230 concurrent sessions. Depending on the environment, the session limit can be reached very quickly. Therefore, apply the capacity auth-code and retrieve a license before you begin testing the VM-Series firewall; otherwise, you might have unpredictable results, if there is other traffic on the port group(s).
Traffic logs do NOT get logged to an unlicensed VM-Series firewall.
Please view this article to register your VM-Series firewall and resolve this issue: How to Authorize or Register a VM