Forum Discussion
Issue collecting Windows Firewall Events
I waited for more than 24 hours and still nothing.
Yes I configured the correct workspace, indeed the Security Events are coming in the Log Analytics Workspace.
Did you eventually find a solution?
WouterStinkens Yes, you need to reduce the size of the log file to few KB. I reduced it to 2 KB and it works!
simonepatonico could you pls tell me if reducing the logfile size to 2KB solved your problem permanently? I was facing the same issue as you and received logs from Windows Firewall as soon as I reduced the logfile size to 2KB but the next day again I couldnt see the Windows Firewall logs.
Did you do try any other solution after reducing the logfile size?
saurabh09 yes I solved the problem reducing the logfile size to 2 KB. However, since windows firewall does not log all the data that I need, I did not use it for Analytics rules in Azure Sentinel. If your machines are VMs in Azure, I suggest you to integrate logs from Network Security Groups but it would require you to setup a custom table in Log Analytics Workspace.
Regards
Simone