MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

15-50 Chapter 15 Configuring Network and Internet Connections
F15us26r.bmp
Figure 15-26 Enable security logging for Windows Firewall.
6. Note the location of the security log. By default, the log file is named pfirewall.log
and is located in the %systemroot% folder. Click OK to close the Log Settings dialog
box. Click OK again to close the Windows Firewall dialog box.
How to Access the Windows Firewall Log File
After you enable logging, you can access the log file by browsing to its location and
opening the file. Log entries provide insight about which packets have been successful
in getting into the network and which have been rejected. There are two sections of
the log: the header and the body. The header includes information about the version
of Windows Firewall, the full name of the Windows Firewall, where the time stamp on
the log learned of the time, and the field names used by the body of the log entry to
display data. The body details the log data.
There are 16 data entries per logged item, which include information about the date and
time the log was written and information about the data that passed. This information
tells which types of packets were opened, closed, dropped, and lost; which protocol
was used in the data transmission; the destination IP address of the data; the port used
by the sending computer; the port of the destination computer; and the size of the
packet logged.
To locate and open the Windows Firewall log file, use these steps:
1. Click Start, and then click Control Panel.
2. In the Control Panel window, click Network And Internet Connections.
3. In the Network And Internet Connections window, click Windows Firewall.
4. In the Windows Firewall dialog box, on the Advanced tab, in the Security Logging
section, click Settings.
5. In the Log Settings dialog box, in the Log File Options section, click Save As.
6. In the Browse dialog box, right-click the pfirewall.txt file, and then click Open.