Logging sucks

[Guest]

[VanguardLH]

Honestly I have never had that problem on any of my of pc's. I know every program on my pc. I never download or install anything I do not know. My hardware firewall stops all inbounds. I use Comodo for the HIPS and program control,

We got your point: You don't care about logging.  So this thread is irrelevant to you.  It is not irrelevant to other users.

[Dennis2]

We got your point: You don't care about logging.  So this thread is irrelevant to you.  It is not irrelevant to other users.

The tighter your rules the more important logging is if you have open rules logging is not a problem each to there own.
I would like sometimes to have UDP and TCP logging for the same app CPF3 will not Kerio(Not Sunbelt) was good for logging too good sometimes outdated now.
Dennis

[sded]

Alas, logging is how I guage the effectiveness of a firewall.  If I cannot monitor that it is working as configured then I have no assurance it is indeed working as configured.  The lack of adequate logging is why I've abandoned other firewalls.

Yeah, logging is pretty much a deal breaker for me too.  I never used CFP2.4 and don't use CFP3 on my XP machines or other Vista computer.  Liked Kerio and Sygate and their logging for XP, now using OA free on one (rarely used backup) and ZAF for my wife.  Second Vista computer is just running Vista firewall  for now until I decide to try something new.  Maybe OA for Vista or the rumored Avast! firewall will be a better fit to it.  That computer is mostly used for navigation on my boat, limited email and web, so not willing to work through a second set of CFP3 issues on it.  Have CFP3 working well on main Vista computer, BTW; just try not to think too much about mysterious things that happen.     But finding user problems is significantly complicated by inability to log.     

[grue155]

When I was doing some digging into CFP logging for some local site reporting needs, I found that the log reporting facility in CFP v3 to be rather limited. There is information in the log data that isn't reported, and there is log data that is summarized but not reported in detail. Example is that protocol information isn't reported, but is present in the log data. And multiple log entries are reduced down to a single line item, reducing the visual impact of a report of a system scan or an attack (really, I'd like to know that somebody tried 3000 packets against my box, rather than a one liner that looks like some stray noise). It's some work, but the data does seem to be available, just not in an informative format.

[sded]

Which logging report are you referring to?  Where do we get additional logging data?  When I go to firewall/common tasks/view firewall events I do get the protocol when the program chooses to log, but can't find other data you mention.  And this is where I would expect all the log data to be.  Or are you talking about the attack detection logging?

[grue155]

It's kind of off-topic in this forum. The stuff I was referencing is in the Dshield reporting topic in the Mod forum, from a post of mine at the end of March.

[Tags:]