It's also possible that you're looking at an event that happened, but cleared itself.

Navigate to Reports -> Events and Notifications and click on "Acknowledge All". If you no longer have any Critical events, this was the case.

B.

The firewall should always be running, but it may be in failsafe mode which only allows restricted access. The bast place for firewall logs is /var/log/system. You can check if the firewall is running OK with a:

service firewall status

Also check if you have a reasonable amount of rules present with:

iptables -nvL