1.\" $OpenBSD: pflogd.8,v 1.35 2007/05/31 19:19:47 jmc Exp $ 2.\" 3.\" Copyright (c) 2001 Can Erkin Acar. All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. The name of the author may not be used to endorse or promote products 14.\" derived from this software without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26.\" 27.Dd September 9, 2010 28.Dt PFLOGD 8 29.Os 30.Sh NAME 31.Nm pflogd 32.Nd packet filter logging daemon 33.Sh SYNOPSIS 34.Nm 35.Bk -words 36.Op Fl \&Dx 37.Op Fl d Ar delay 38.Op Fl f Ar filename 39.Op Fl i Ar interface 40.Op Fl p Ar pidfile 41.Op Fl s Ar snaplen 42.Op Ar expression 43.Ek 44.Sh DESCRIPTION 45.Nm 46is a background daemon which reads packets logged by 47.Xr pf 4 48to a 49.Xr pflog 4 50interface, normally 51.Pa pflog0 , 52and writes the packets to a logfile (normally 53.Pa /var/log/pflog ) 54in 55.Xr tcpdump 1 56binary format. 57These logs can be reviewed later using the 58.Fl r 59option of 60.Xr tcpdump 1 , 61hopefully offline in case there are bugs in the packet parsing code of 62.Xr tcpdump 1 . 63.Pp 64.Nm 65closes and then re-opens the log file when it receives 66.Dv SIGHUP , 67permitting 68.Xr newsyslog 8 69to rotate logfiles automatically. 70.Dv SIGALRM 71causes 72.Nm 73to flush the current logfile buffers to the disk, thus making the most 74recent logs available. 75The buffers are also flushed every 76.Ar delay 77seconds. 78.Pp 79If the log file contains data after a restart or a 80.Dv SIGHUP , 81new logs are appended to the existing file. 82If the existing log file was created with a different snaplen, 83.Nm 84temporarily uses the old snaplen to keep the log file consistent. 85.Pp 86.Nm 87tries to preserve the integrity of the log file against I/O errors. 88Furthermore, integrity of an existing log file is verified before 89appending. 90If there is an invalid log file or an I/O error, the log file is moved 91out of the way and a new one is created. 92If a new file cannot be created, logging is suspended until a 93.Dv SIGHUP 94or a 95.Dv SIGALRM 96is received. 97.Pp 98The options are as follows: 99.Bl -tag -width Ds 100.It Fl D 101Debugging mode. 102.Nm 103does not disassociate from the controlling terminal. 104.It Fl d Ar delay 105Time in seconds to delay between automatic flushes of the file. 106This may be specified with a value between 5 and 3600 seconds. 107If not specified, the default is 60 seconds. 108.It Fl f Ar filename 109Log output filename. 110Default is 111.Pa /var/log/pflog . 112.It Fl i Ar interface 113Specifies the 114.Xr pflog 4 115interface to use. 116By default, 117.Nm 118will use 119.Ar pflog0 . 120.It Fl p Ar pidfile 121Writes a file containing the process ID of the program. 122The file name has the form 123.Pa /var/run/pidname.pid . 124If the option is not given, 125.Ar pidfile 126defaults to 127.Pa pflogd . 128.It Fl s Ar snaplen 129Analyze at most the first 130.Ar snaplen 131bytes of data from each packet rather than the default of 116. 132The default of 116 is adequate for IP, ICMP, TCP, and UDP headers but may 133truncate protocol information for other protocols. 134Other file parsers may desire a higher snaplen. 135.It Fl x 136Check the integrity of an existing log file, and return. 137.It Ar expression 138Selects which packets will be dumped, using the regular language of 139.Xr tcpdump 1 . 140.El 141.Sh FILES 142.Bl -tag -width /var/run/pflogd.pid -compact 143.It Pa /var/run/pflogd.pid 144Process ID of the currently running 145.Nm . 146.It Pa /var/log/pflog 147Default log file. 148.El 149.Sh EXAMPLES 150Log specific tcp packets to a different log file with a large snaplen 151(useful with a log-all rule to dump complete sessions): 152.Bd -literal -offset indent 153# pflogd -s 1600 -f suspicious.log port 80 and host evilhost 154.Ed 155.Pp 156Log from another 157.Xr pflog 4 158interface, excluding specific packets: 159.Bd -literal -offset indent 160# pflogd -i pflog3 -f network3.log "not (tcp and port 23)" 161.Ed 162.Pp 163Display binary logs: 164.Bd -literal -offset indent 165# tcpdump -n -e -ttt -r /var/log/pflog 166.Ed 167.Pp 168Display the logs in real time (this does not interfere with the 169operation of 170.Nm ) : 171.Bd -literal -offset indent 172# tcpdump -n -e -ttt -i pflog0 173.Ed 174.Pp 175Tcpdump has been extended to be able to filter on the pfloghdr 176structure defined in 177.In net/pf/if_pflog.h . 178Tcpdump can restrict the output 179to packets logged on a specified interface, a rule number, a reason, 180a direction, an IP family or an action. 181.Pp 182.Bl -tag -width "ruleset authpf " -compact 183.It ip 184Address family equals IPv4. 185.It ip6 186Address family equals IPv6. 187.It ifname kue0 188Interface name equals "kue0". 189.It on kue0 190Interface name equals "kue0". 191.It ruleset authpf 192Ruleset name equals "authpf". 193.It rulenum 10 194Rule number equals 10. 195.It reason match 196Reason equals match. 197Also accepts "bad-offset", "fragment", "bad-timestamp", "short", 198"normalize", "memory", "congestion", "ip-option", "proto-cksum", 199"state-mismatch", "state-insert", "state-limit", "src-limit", 200and "synproxy". 201.It action pass 202Action equals pass. 203Also accepts "block". 204.It inbound 205The direction was inbound. 206.It outbound 207The direction was outbound. 208.El 209.Pp 210Display the logs in real time of inbound packets that were blocked on 211the wi0 interface: 212.Bd -literal -offset indent 213# tcpdump -n -e -ttt -i pflog0 inbound and action block and on wi0 214.Ed 215.Sh SEE ALSO 216.Xr tcpdump 1 , 217.Xr pcap 3 , 218.Xr pf 4 , 219.Xr pflog 4 , 220.Xr pf.conf 5 , 221.Xr newsyslog 8 222.Sh HISTORY 223The 224.Nm 225command appeared in 226.Ox 3.0 . 227.Sh AUTHORS 228.Nm 229was written by 230.An Can Erkin Acar Aq Mt canacar@openbsd.org . 231