1pass log (user) all flags S/SA 2pass log (all) all flags S/SA 3pass log (to pflog7) all flags S/SA 4block drop log (all, user, to pflog1) all 5block drop log (user, to pflog1) all 6