Watching /var/log/pflog grow

Sahil Tandon sahil at
Tue Nov 4 18:22:47 PST 2008

cpghost <cpghost at> wrote:

> How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
> This won't work:
>   $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> because tail doesn't start at the right location.


> I'm afraid that in the latter case, every packet will be
>   EITHER logged by pflogd
>   XOR    displayed by tcpdump.
> Is that so?
> If yes, /var/log/pflog would be incomplete, because some packets
> would have been snatched away from pflog0 by tcpdump, before
> pflogd ever got a chance to read them out.
> Is there a way to watch /var/log/pflog grow, while
> still making sure that pflogd logs EVERY packet that appears
> on the pflog0 interface? How?

According to pflogd(8):

   Display the logs in real time (this does not interfere with the
   operation of pflogd):

          # tcpdump -n -e -ttt -i pflog0

Sahil Tandon <sahil at>

More information about the freebsd-questions mailing list