Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. LogFiles
  5. Firewall
  6. pfirewall.log
LogRisk: Caution

pfirewall.log C:\Windows\System32\LogFiles\Firewall\pfirewall.log

Windows Firewall log: dropped packets and allowed connections, when logging is enabled for the profile.

Updated on By AltF4 Formation

What it’s for

pfirewall.log records the packets Windows Firewall allowed or dropped. Use it to work out why a connection is blocked, or to check that a rule really lets the expected traffic through. It exists only if you have turned logging on; it is off by default.

What it contains

  • Dropped packets if “Log dropped packets” is on.
  • Successful connections if “Log successful connections” is on.
  • On each line: date, time, action, protocol, source and destination addresses and ports, size, TCP flags, and, as the last field, the traffic direction.

Risks and best practices

  • The default size (4,096 KB) is too small. Microsoft recommends at least 20,480 KB; the maximum is 32,767 KB.
  • Log dropped packets. Successful connections produce a huge volume and are only useful for targeted troubleshooting: turn them off afterwards.
  • The file contains internal IP addresses. Protect copies of it.
  • To archive or delete the file, turn logging off first or wait for the rollover: it is open for writing.

Useful commands

Fenêtre de terminal
# Logging settings of each profile
Get-NetFirewallProfile | Select-Object Name, LogBlocked, LogAllowed, LogFileName, LogMaxSizeKilobytes


# Last lines
Get-Content "$env:windir\System32\LogFiles\Firewall\pfirewall.log" -Tail 30


# Dropped packets
Select-String -Path "$env:windir\System32\LogFiles\Firewall\pfirewall.log" -Pattern " DROP " | Select-Object -Last 20


# Enable dropped-packet logging, 20 MB (as administrator); test with -WhatIf first
Set-NetFirewallProfile -Name Domain,Private,Public -LogBlocked True -LogMaxSizeKilobytes 20480 -WhatIf

Format

W3C extended text: a header (#Version, #Fields) describes the columns, then one line per event. The action is typically ALLOW or DROP.

Rotation and archiving

The maximum size is set per profile. When the file reaches it, Windows renames it to pfirewall.log.old (overwriting the previous one) and starts a new file. To keep history, copy the .old file regularly.

How to read it

Read the #Fields line for the column order, then filter on the IP address or port involved with Select-String. The last field, path, gives the direction: SEND or RECEIVE.

Report a mistake