ASA is logging return traffic not only the traffic that was logged

[mishadib]

Hi, 

On a FPR running in ASA mode, i have logged an ACE for traffic leaving this interface (incoming from ASA context). The logs are being sent to Elastic. When I am looking for the logs I see some strange results. This is my ACE: 

access-list acl_A extended permit ip object-group grp-B 10.0.0.0 255.0.0.0 log warnings

and how it is associated:

access-group acl_A in interface C

So normally i should only see in Elastic logs from traffic coming from interface C with well-known destination port and source dynamic ports. 

What I see is also some traffic originating from well-known ports to dynamic destinations ports. To me this seems like returning traffic resulting from stateful inspection. Why is this being logged?

[MHM Cisco World]

""So normally i should only see in Elastic logs from traffic coming from interface C with well-known destination port and source dynamic ports.""

I dont get this' the ACL apply as INbound so traffic come to Interface C and hit the ACL will generate Log.

MHM

[mishadib]

Isn't it the other way around? What am I getting wrong? ACL should be from the ASA context point of view right? 

PS: All my traffic is originating from Interface C devices 

[MHM Cisco World]

DeviceA-ASA(interface C)

Your shown ACL will filter traffic come from deviceA to ASA(interface C).

MHM

[mishadib]

Sorry maybe i didn't understand something or i didn't express myself ok or I am stupid  
This is what i have : 

Traffic would flow like this: 
Let's take ACL_A : This ACL would filter traffic comming from Dev A and going to either Inside, B or C interfaces. 
Am I correct? 

[MHM Cisco World]

You share access-group can I see acl?

Also insideA/B/C have same secuirty level?

MHM

[mishadib]

the ACL_A has something like this : 

access-list acl_A extended permit ip object-group DEV A 10.0.0.0 255.0.0.0 log warnings

interfaces A, B and C have Security 0 
inside has 100