Date: Tue, 4 Nov 2008 21:22:42 -0500 From: Sahil Tandon <sahil@tandon.net> To: freebsd-questions@freebsd.org Subject: Re: Watching /var/log/pflog grow Message-ID: <20081105022242.GA1178@shepherd> In-Reply-To: <20081104191354.GA1819@phenom.cordula.ws> References: <20081104191354.GA1819@phenom.cordula.ws>
next in thread | previous in thread | raw e-mail | index | archive | help
cpghost <cpghost@cordula.ws> wrote:
> How can I watch /var/log/pflog grow with tcpdump, "tail -f" style?
>
> This won't work:
> $ tail -f /var/log/pflog | tcpdump -n -s 116 -r -
> because tail doesn't start at the right location.
[...]
> I'm afraid that in the latter case, every packet will be
> EITHER logged by pflogd
> XOR displayed by tcpdump.
> Is that so?
>
> If yes, /var/log/pflog would be incomplete, because some packets
> would have been snatched away from pflog0 by tcpdump, before
> pflogd ever got a chance to read them out.
>
> Is there a way to watch /var/log/pflog grow, while
> still making sure that pflogd logs EVERY packet that appears
> on the pflog0 interface? How?
According to pflogd(8):
Display the logs in real time (this does not interfere with the
operation of pflogd):
# tcpdump -n -e -ttt -i pflog0
--
Sahil Tandon <sahil@tandon.net>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081105022242.GA1178>