Watching /var/log/pflog grow

[cpghost]

On Tue, Nov 04, 2008 at 05:15:57PM -0800, Jeremy Chadwick wrote:
> On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote:
> > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
> > 
> > This won't work:
> >   $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> > because tail doesn't start at the right location.
> > 
> > Using a blocksize (-b) with tail may also not be right,
> > because the captured packets are not the same size.
> > 
> > This seems to work:
> >   $ tcpdump -n -s 116 -i pflog0
> > but now, both tcpdump and pflogd are competing for the same
> > interface pflog0.
> > 
> > I'm afraid that in the latter case, every packet will be
> >   EITHER logged by pflogd
> >   XOR    displayed by tcpdump.
> > Is that so?
> > 
> > If yes, /var/log/pflog would be incomplete, because some packets
> > would have been snatched away from pflog0 by tcpdump, before
> > pflogd ever got a chance to read them out.
> > 
> > Is there a way to watch /var/log/pflog grow, while
> > still making sure that pflogd logs EVERY packet that appears
> > on the pflog0 interface? How?
> 
> Please post this to freebsd-pf, where you can get better help.

Thank you, but the problem seems solved (pflog0 delivers copies of
packets). I'll test this tomorrow and should I miss some packets
in the log file, I'll surely raise the question again.

Thanks you all for helping, on and off list.

-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/