Event list gets empty VERY VERY often

Comodo Internet Security - CIS Install / Setup / Configuration Help - CIS
1

what I can not understand is why the firewall event list get empty so often ??? I almost do not have firewall alerts but still it gets empty so I am not able to see the few entries in the event list.
Look at the screenshot … 9 intrusions but no entries in the event list. And this is always, i can not remember to see any event entries…and if yes, soon the list was empty again.

I noticed this a long time ago in the very earlier versions of CIS 5.

I use the latest version of CIS 5 on both OS Win7 and WinXP. This misfunction is present only on the Win7 system. On XP the event list is getting longer and longer and I can see events dating many months back. On both OS Comodo is set to delete the log file if it exceeds 50MB. But this can not happen where I do see that the intrusion counter on the main window shows a little amount of CF entries (in my actual case only 9 intrusions are seeing in the screenshot). And on WinXP the list is a way larger that on Win7 but still it gets not empty. ???

what is wrong?
I hope there is any solution

[attachment deleted by admin]

2

What global firewall rules do you have on the two systems?

3

where can I see this?

4

Firewall/Network Security Policy/Global Rules

5

in the screenshot the global rules of the XP system.
Wait for the global rules of the Win7 sysrem later

[attachment deleted by admin]

6

With the default Stealth Global Rules, which are you using, logging is no longer enabled by default.

If you change the block rule at the bottom to block and log you will see all traffic that gets blocked,

7

oh, I believe you did not understand me right :-\

  1. it is not about that I dont see the logging entries, but it is about that the entries get DELETED in a very soon time. I do see the asked (and blocked) entries in the event list but these are delited even some minutes (!!!) later.

  2. the screenshot I have post in my last posting was from the XP system where I do not have this issue and the event list contains the entries from the install date of CIS

  3. My issue occurs on my Win7 system, where the entries in the event list are removed very soon. I will post soon the screenshot of the global rules. But I dont think that this is the point

any help now after clarifying?

8

Are both your computers using CIS 5.x? If you are using v6 it will show the last 24 hrs by default. If you want to see longer periods you can but it takes a couple of actions.

9

both have CIS 5
And I can not understand why the CIS on the one PC (XP) shows me the events 4 months ago and CIS on Win7 delets them after appr. 4 hours ??? I hardly believe it is a bug :-\

10

no chance for help ?

11

this the global rules of the Win7 system with this issue. But I dont think it is relevant

[attachment deleted by admin]

12

ok, does some one has more info about this related issues:
https://forums.comodo.com/firewall-help-cis/firewall-events-missing-t75273.0.html
https://forums.comodo.com/firewall-help-cis/log-file-problem-t73209.0.html

13

Sorry you not likely to get any answers.

There have been a few posts like those with logging problems, nothing that I can remember that actually fixed there problems or found why they were happening.

All I can suggest is to try changing the size of logs, or uninstall / reinstall.

I am sorry but I cannot say whether either suggestion will fix your problem.

Dennis

14

here the workaround working for me (Win7 x64, SP1):

  • in AVAST → WebShield → Expert Settings → Exclusions under Processes to exclude I added all the .exe files of the Comodo install folder
  • in CIS → Defense+ → Computer Security Policy I find the process AvastSvc.exe and edit the rule for this file using the Custom Policy and set all the entries in there (without "run an executable) to Allow

Now the event lists for Firewall and D+ contain the entries for more than 2 weeks.

hope it works for you too.