How do firewalls help document what happens on a network?

What will be an ideal response?

Every firewall should be configured to provide information to the network administrator in the form of log files. Log files record attempted intrusions and other suspicious activity, as well as mundane events like legitimate file accesses, unsuccessful connection attempts, and the like. Looking through log files is tedious, but it can help a network administrator identify weak points in the security system so they can be strengthened.

Log files can also identify intruders so they can be apprehended in case theft or damage actually occur. Regular review and analysis of log file data are what make firewalls effective because methods of attack change all the time. The firewall rules must be evaluated and adjusted to account for the many new and emerging threats.