Windows network WFP

This is my third issue with WFP. Every time a connect/accept is pended the
driver has to set block and absorb. This results in an entry in the OS
security log (docs state otherwise). Is anybody actually using the pend
functions for ALE connects and accepts? I don’t see how this can be used
with the event log having an entry for each operation. What am I missing?

Bill Wandel