1.\" $OpenBSD: pflogd.8,v 1.24 2004/01/16 10:45:49 jmc Exp $ 2.\" $DragonFly: src/usr.sbin/pflogd/pflogd.8,v 1.1 2004/09/21 21:25:28 joerg Exp $ 3.\" 4.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27.\" 28.Dd July 9, 2001 29.Dt PFLOGD 8 30.Os 31.Sh NAME 32.Nm pflogd 33.Nd packet filter logging daemon 34.Sh SYNOPSIS 35.Nm pflogd 36.Op Fl Dx 37.Op Fl d Ar delay 38.Op Fl f Ar filename 39.Op Fl s Ar snaplen 40.Op Ar expression 41.Sh DESCRIPTION 42.Nm 43is a background daemon which reads packets logged by 44.Xr pf 4 45to the packet logging interface 46.Pa pflog0 47and writes the packets to a logfile (normally 48.Pa /var/log/pflog ) 49in 50.Xr tcpdump 8 51binary format. 52These logs can be reviewed later using the 53.Fl r 54option of 55.Xr tcpdump 8 , 56hopefully offline in case there are bugs in the packet parsing code of 57.Xr tcpdump 8 . 58.Pp 59.Nm 60closes and then re-opens the log file when it receives 61.Dv SIGHUP , 62permitting 63.Xr newsyslog 8 64to rotate logfiles automatically. 65.Dv SIGALRM 66causes 67.Nm 68to flush the current logfile buffers to the disk, thus making the most 69recent logs available. 70The buffers are also flushed every 71.Ar delay 72seconds. 73.Pp 74If the log file contains data after a restart or a 75.Dv SIGHUP , 76new logs are appended to the existing file. 77If the existing log file was created with a different snaplen, 78.Nm 79temporarily uses the old snaplen to keep the log file consistent. 80.Pp 81.Nm 82tries to preserve the integrity of the log file against I/O errors. 83Furthermore, integrity of an existing log file is verified before 84appending. 85If there is an invalid log file or an I/O error, logging is suspended until a 86.Dv SIGHUP 87or a 88.Dv SIGALRM 89is received. 90.Pp 91The options are as follows: 92.Bl -tag -width Ds 93.It Fl D 94Debugging mode. 95.Nm 96does not disassociate from the controlling terminal. 97.It Fl d Ar delay 98Time in seconds to delay between automatic flushes of the file. 99This may be specified with a value between 5 and 3600 seconds. 100If not specified, the default is 60 seconds. 101.It Fl f Ar filename 102Log output filename. 103Default is 104.Pa /var/log/pflog . 105.It Fl s Ar snaplen 106Analyze at most the first 107.Ar snaplen 108bytes of data from each packet rather than the default of 96. 109The default of 96 is adequate for IP, ICMP, TCP, and UDP headers but may 110truncate protocol information for other protocols. 111Other file parsers may desire a higher snaplen. 112.It Fl x 113Check the integrity of an existing log file, and return. 114.It Ar expression 115Selects which packets will be dumped, using the regular language of 116.Xr tcpdump 8 . 117.El 118.Sh FILES 119.Bl -tag -width /var/run/pflogd.pid -compact 120.It Pa /var/run/pflogd.pid 121Process ID of the currently running 122.Nm . 123.It Pa /var/log/pflog 124Default log file. 125.El 126.Sh EXAMPLES 127Log specific tcp packets to a different log file with a large snaplen 128(useful with a log-all rule to dump complete sessions): 129.Bd -literal -offset indent 130# pflogd -s 1600 -f suspicious.log port 80 and host evilhost 131.Ed 132.Pp 133Display binary logs: 134.Bd -literal -offset indent 135# tcpdump -n -e -ttt -r /var/log/pflog 136.Ed 137.Pp 138Display the logs in real time (this does not interfere with the 139operation of 140.Nm ) : 141.Bd -literal -offset indent 142# tcpdump -n -e -ttt -i pflog0 143.Ed 144.Pp 145Tcpdump has been extended to be able to filter on the pfloghdr 146structure defined in 147.Aq Ar net/if_pflog.h . 148Tcpdump can restrict the output 149to packets logged on a specified interface, a rule number, a reason, 150a direction, an IP family or an action. 151.Pp 152.Bl -tag -width "reason match " -compact 153.It ip 154Address family equals IPv4. 155.It ip6 156Address family equals IPv6. 157.It ifname kue0 158Interface name equals "kue0". 159.It on kue0 160Interface name equals "kue0". 161.It rulenum 10 162Rule number equals 10. 163.It reason match 164Reason equals match. 165Also accepts "bad-offset", "fragment", "short", "normalize" and "memory". 166.It action pass 167Action equals pass. 168Also accepts "block". 169.It inbound 170The direction was inbound. 171.It outbound 172The direction was outbound. 173.El 174.Pp 175Display the logs in real time of inbound packets that were blocked on 176the wi0 interface: 177.Bd -literal -offset indent 178# tcpdump -n -e -ttt -i pflog0 inbound and action block and on wi0 179.Ed 180.Sh SEE ALSO 181.Xr pcap 3 , 182.Xr pf 4 , 183.Xr pflog 4 , 184.Xr pf.conf 5 , 185.Xr newsyslog 8 , 186.Xr tcpdump 8 187.Sh HISTORY 188The 189.Nm 190command appeared in 191.Ox 3.0 . 192.Sh AUTHORS 193Can Erkin Acar 194