Without hard disks, firewall logs are mainly stored in memory. After the device restarts, the logs are lost.
Some key logs (such as interface up/down logs) are stored in the CF card. You can view the logs in diagnosis information.
As network technologies advance, enterprises have increasingly higher requirements for visualized management. The basic requirement for firewalls is to provide multi-dimensional rankings and trends and visualized reports. Storage of massive log data is a prerequisite for diversified reports.
Simply speaking, hard disks are used to store logs and reports.