ENSM Firewall doesn't have a separate log file. Firewall logging doesn't show up in /var/log/system.log. Firewall logging is part of the device log accessible via the macOS Console application only. The entries start with MFE_SFW.

To view ENSM Firewall logging:

1. Click the Finder application. It looks like a blue and white face and is located in your Dock.
2. Select Applications in the left sidebar.
3. Open the application you want to keep in your Dock. It appears to the right of the applications already pinned to your Dock.
4. In the application, click the device name at the top-left corner. The current logging displays. The logging entries for Firewall start with MFE_SFW.

Due to the operating system, there isn't a log file; it's live traffic. You need to export the data manually into a text file for further research or if you plan on sharing it with Technical Support. 

The market offers applications for export and monitoring. We don't support such solutions; we recommend the following:

1. Enable debug logging for the Firewall module using KB91797 - Enable debug logging to troubleshoot Endpoint Security issues.
2. Click Console from the menu at the top-left corner of the new window. You can see the log activities on the screen.
3. Perform the actions you want to log, such as an application block or crash.
4. Copy and paste the log lines into a text file.