I have enabled the built-in firewall on my MacBook (Sierra v10.12.1), but unfortunately the log files located in /var/log (appfirewall.log and alf.log) stay empty. I contacted Apple Support but they don't know the reason or a solution to this problem. I saw someone with a similar problem and concerns at: Firewall logging enabled, but not recording which isn't resolved.
Any ideas how to handle this one?
To get some logging from the Firewall you have to define some rules.
Open System Preferences > Security & Privacy > Firewall, unlock it, and select
Firewall Options and add some rules about application you want to block any access from the outside.
Ex. :
Once done, lock back the Security & Privacy preference menu.
Try any prohibited or allowed access and you will see it appear in /var/log/appfirewall.log.
