Microsoft Windows Firewall
Microsoft Windows Event Sender (WES) (Deprecated) must be running if you want to use this setup procedure.
Use the following steps to set up the log message sending from Windows Firewall to Logmanager:
-
Run firewall configuration console using the command wf.msc.
Running configuration
-
On the right-hand side, select Properties.
Dashboard
-
On the Domain Profile tab, click Customize for Logging.
Profiles
- Create a copy of the log file path to the clipboard for future use.
- Select yes on Log dropped packets.
- Select yes on Log successful connections.
- To save this configuration, click OK.
Customizing logging
-
Repeat the previous steps for Private Profile and Public Profile tabs.
This procedure demonstrates the GUI configuration for all available messages.
-
Configure Logmanager to watch the log files on Windows Server with Windows Firewall. Follow the Chapter Windows.
-
We find the computer with Windows Firewall and we need to set following properties on Editing client station page:
- Set log type to value text
- Paste the log file path from your clipboard into textbox log source
Editing agent
Now, WES agent will start sending Windows Firewall messages to Logmanager.