Firewall action log values
The Firewall log can include an action field listing the action performed by the Microsoft Firewall Service for the current session or connection. The values provided in the "Action" field are short strings derived from the names of the enumeration values defined in the FpcAction COM object after deleting the prefix "fpcAction."
The following table lists the possible action values.
| SQL Server Express value | Value | String | Description |
|---|---|---|---|
0 |
NotLogged |
- |
No action was logged. |
1 |
Bind |
- |
The Firewall service associated a local address with a socket. |
2 |
Listen |
- |
The Firewall service placed a socket in a state in which it listens for an incoming connection. |
3 |
GHBN |
- |
Get host by name request. The Firewall service retrieved host information corresponding to a host name. |
4 |
GHBA |
- |
Get host by address request. The Firewall service retrieved host information corresponding to a network address. |
5 |
RedirectBind |
- |
The Firewall service enabled a connection using a local address associated with a socket. |
6 |
Establish |
Initiated connection |
The Firewall service established a session. |
7 |
Terminate |
Closed connection |
The Firewall service terminated a session. |
8 |
Denied |
Denied connection |
The action requested was denied. |
9 |
Allowed |
Allowed connection |
The action requested was allowed. |
10 |
Failed |
Failed connection |
The action requested failed. |
11 |
Intermediate |
- |
The action was intermediate. |
12 |
SuccessfulConnection |
- |
The Firewall service was successful in establishing a connection to a socket. |
13 |
UnsuccessfulConnection |
- |
The Firewall service was unsuccessful in establishing a connection to a socket. |
14 |
Disconnect |
- |
The Firewall service closed a connection on a socket. |
15 |
UserClearedQuarantine |
User cleared quarantine |
The Firewall service cleared a quarantined virtual private network (VPN) client. |
16 |
QuarantineTimeout |
Quarantine timeout |
The Firewall service disqualified a quarantined VPN client after the time-out period elapsed. |