Firewall Logging - Outbound Program Names?

Question

How can I add to the advanced firewall logs the specific names of outbound programs each time they are blocked?

I've set the built-in firewall (advanced) so outbound connections that do not match a rule are blocked, and I'm adding per-program outbound rules as needed.   That works perfectly, but I also want to log the name of each program that FAILS to get an outbound connection, to help me decide what rules to add.   I enabled logging for both dropped packets and successful connections in all three profiles temporarily, and in event viewer I enabled the verbose log for the firewall.  My own firewall rule change events and pfirewall.log file are being populated, but neither shows the names of individual blocked outgoing applications.

What might I have missed?

Answer 1

Based on every reference posted, for outgoing connections the firewall can log only the ip address and port, not the name and path of the program requesting the connection, and that's that.

Answer 2

Hi,

Wonder if its possible that you don't understand the topic....... the question added by the 2nd OP

I answered was about Outbound Logging.

Have a nice day.

---

Rob Brown - MS MVP - Windows Desktop Experience : Bicycle - Mark Twain said it right.

It looks like correct answer is short: Windows 7 Firewall can't log outbound connections (Home Premium version at least). Instead of that we've got tons of useless links wasting our time.

Answer 3

How can I add to the advanced firewall logs the specific names of outbound programs each time they are blocked?

I've set the built-in firewall (advanced) so outbound connections that do not match a rule are blocked, and I'm adding per-program outbound rules as needed.   That works perfectly, but I also want to log the name of each program that FAILS to get an outbound connection, to help me decide what rules to add.   I enabled logging for both dropped packets and successful connections in all three profiles temporarily, and in event viewer I enabled the verbose log for the firewall.  My own firewall rule change events and pfirewall.log file are being populated, but neither shows thenames of individual blocked outgoing applications.

What might I have missed? 

Same question here.  I can get the firewall to block outbound connections, and I know how to put exceptions in.  But, how do I know what to 'un-block'?  You can't necessarily unblock a single EXE file and have everything work.  For example, I cannot get my virus scanner (McAfee) to update.  I've unblocked what I think is the update application but apparently there's more that one application in play.  Does the Windows 7 firewall log blocked outbound applications?

Answer 4

Thanks, but neither of those links helps me add the particular logging feature I need.

Answer 5

Hi,

Check these :

How to Add or Delete an Exception in Windows Firewall in Vista

http://www.vistax64.com/tutorials/65334-windows-firewall.html

How to Use Windows Firewall With Advanced Security in Vista

http://www.vistax64.com/tutorials/92748-windows-firewall-advanced-security.html

Hope this helps.

---

Rob - Bicycle - Mark Twain said it right.