Firewall Log not respecting settings -- Logs not extending beyond a few hours

boethius · Dec 30, 2022

Hello,
I configured firewall logs to log all events (blocks, accepts) and set the logfile size to maximum (32,xxxKb).
This was working as expected for a while and then began to only write about ~3000-4000Kb before rotating to log.old.
I've googled this and can find no significant conversation on the matter, it seems pretty straightforward, except for the behavior I am experiencing.
The PC is self-managed, not part of any Active Directory infrastructure, not part of any corp, with no one else administrating but myself.

Code:

PS C:\WINDOWS\system32\logfiles\Firewall> dir
Directory: C:\WINDOWS\system32\logfiles\Firewall                                                                                                                                          Mode                 LastWriteTime         Length Name
    12/30/2022   1:20 AM        3083948 pfirewall.log                                                         
12/29/2022  10:49 PM        4201141 pfirewall.log.old                                                                                                                                      C:\WINDOWS\system32\logfiles\Firewall>

neemobeer · Dec 30, 2022

Do you have it enabled for standard and not domain?

boethius · Dec 30, 2022

neemobeer said:
Do you have it enabled for standard and not domain?

It is enabled for the public profile which is the only active profile. It is logging, but not retaining the logs.

neemobeer · Dec 30, 2022

Have you verified your system is on the public profile?
4096KB is the default size, looks like another profile may be enabled and overriding.

May also help to change the log name to something unique to prevent overriding it such as
%systemroot%\system32\LogFiles\Firewall\pfirewall-public.log

In Powershell

Powershell:

(Get-NetConnectionProfile).NetworkCategory

boethius · Jan 1, 2023

neemobeer said:
Have you verified your system is on the public profile?
4096KB is the default size, looks like another profile may be enabled and overriding.

May also help to change the log name to something unique to prevent overriding it such as
%systemroot%\system32\LogFiles\Firewall\pfirewall-public.log

In Powershell

Powershell:

(Get-NetConnectionProfile).NetworkCategory

PS C:\Users\boethius> (Get-NetConnectionProfile).NetworkCategory
Public
Public
PS C:\Users\boethius>

boethius · Jan 30, 2023

neemobeer said:
Have you verified your system is on the public profile?
4096KB is the default size, looks like another profile may be enabled and overriding.

May also help to change the log name to something unique to prevent overriding it such as
%systemroot%\system32\LogFiles\Firewall\pfirewall-public.log

In Powershell

Powershell:

(Get-NetConnectionProfile).NetworkCategory

Just to update -- changing the name of the log file did indeed correct the problem. I don't know why it was necessary, but thank you for the suggestion. :thumbsup: