If you attempt to view the log for a rule with an action of offload, the current 'egrep' string does not match the 'O' character, which prevents the log entries from showing. Adding 'O' to the 'ADRJC' portion allows the log messages to show.
set ipv4 forward filter rule 1 action 'offload' set ipv4 forward filter rule 1 log set ipv4 forward filter rule 1 offload-target 'OT1' set ipv4 forward filter rule 1 state 'established' set ipv4 forward filter rule 1 state 'related' root@R86S:/opt/vyatta/share/vyatta-op/templates/show/log/firewall/ipv4/forward/filter/rule/node.tag# cat node.def help: Show log for a rule in the specified firewall allowed: /bin/cli-shell-api listActiveNodes firewall ipv4 forward filter rule | sed -e "s/'//g" && echo run: journalctl --no-hostname --boot -k | egrep "\[ipv4-FWD-filter-$8-[ADRJC]\]" l0crian@R86S# run show log firewall ipv4 forward filter rule 1 [edit] root@R86S:/opt/vyatta/share/vyatta-op/templates/show/log/firewall/ipv4/forward/filter/rule/node.tag# cat node.def help: Show log for a rule in the specified firewall allowed: /bin/cli-shell-api listActiveNodes firewall ipv4 forward filter rule | sed -e "s/'//g" && echo run: journalctl --no-hostname --boot -k | egrep "\[ipv4-FWD-filter-$8-[ADRJCO]\]" l0crian@R86S# run show log firewall ipv4 forward filter rule 1 additional log messages omitted .............................. Mar 15 21:53:52 kernel: [ipv4-FWD-filter-1-O]IN=eth0.4040 OUT=eth6.......................