Watching /var/log/pflog grow
Jeremy Chadwick
koitsu at FreeBSD.org
Tue Nov 4 17:16:02 PST 2008
On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote:
> How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
>
> This won't work:
> $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> because tail doesn't start at the right location.
>
> Using a blocksize (-b) with tail may also not be right,
> because the captured packets are not the same size.
>
> This seems to work:
> $ tcpdump -n -s 116 -i pflog0
> but now, both tcpdump and pflogd are competing for the same
> interface pflog0.
>
> I'm afraid that in the latter case, every packet will be
> EITHER logged by pflogd
> XOR displayed by tcpdump.
> Is that so?
>
> If yes, /var/log/pflog would be incomplete, because some packets
> would have been snatched away from pflog0 by tcpdump, before
> pflogd ever got a chance to read them out.
>
> Is there a way to watch /var/log/pflog grow, while
> still making sure that pflogd logs EVERY packet that appears
> on the pflog0 interface? How?
Please post this to freebsd-pf, where you can get better help.
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
More information about the freebsd-questions
mailing list