I have 10 domain controllers enabled with Windows Firewall for incoming connections. Incoming connection doesn't have a firewall rule will be blocked. To validate we have enabled dropped windows firewall logs. Log collection on sentinel not happening after enabling only dropped firewall logs.
I investigated and found the management pack named “Microsoft.IntelligencePacks.FirewallLog.701” is responsible to collect data. The configuration says it capture data from the file with “*.log.old ” extension.
On the domain controller logging works only on the “pfirewall.log”. File with “.log.old” generates only with the “pfirewall.log" log file got filled. Since we modified dropped log capture the file size is not getting increase, so the new file with “*.log.old ” extension not getting created.
The log file size could be reduced but the log data varies greatly between DCs. If I set the file size too small, we will lose the log data on the servers.
We need to find a better solution.
