From owner-freebsd-questions@FreeBSD.ORG Tue Jan 22 17:45:32 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1878A16A418 for ; Tue, 22 Jan 2008 17:45:32 +0000 (UTC) (envelope-from zszalbot@gmail.com) Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.188]) by mx1.freebsd.org (Postfix) with ESMTP id 9EB8813C442 for ; Tue, 22 Jan 2008 17:45:31 +0000 (UTC) (envelope-from zszalbot@gmail.com) Received: by nf-out-0910.google.com with SMTP id b2so516586nfb.33 for ; Tue, 22 Jan 2008 09:45:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=TYtonvwptVknHR0INFa+GGnD2NRG84lGvE/dfs8ZRtI=; b=uMv6r73m18PWQDsOG0OF76X8tZj9J2FLuDo9zxXFBCNm/Y1DmqgTSvqgl3kCtgGGkROlft4VB3bDtZqqJH46pX8SSJfaoy6sM03/dLwhKXV9ZJRYTKPltZ3uBqEv+W9cpGnuGvf4wgTNSr82i0nM+5CoiDZmmOtorZJQHiRKBk8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=F8ymIdJeYifcW32t4X3S5tWLQipshTjahc7L5T8dEffBF0QxVL/7zIhtutEB9GxV7ywCxn+UMbzPkGS8vFiPz1X1RNSyPQQQaFtifMwIxLr1O06ck0ZxXRP3bf6IHfIJuc79IUnBs3d9VHi8seP8PhbMhEghKs7TFRaw2/zgVzU= Received: by 10.78.131.8 with SMTP id e8mr11652510hud.52.1201023929856; Tue, 22 Jan 2008 09:45:29 -0800 (PST) Received: by 10.78.130.5 with HTTP; Tue, 22 Jan 2008 09:45:29 -0800 (PST) Message-ID: <94136a2c0801220945j164eaf9clffeeda7186242cd1@mail.gmail.com> Date: Tue, 22 Jan 2008 18:45:29 +0100 From: "Zbigniew Szalbot" To: "Rakhesh Sasidharan" In-Reply-To: <20080122211202.Q45709@dogmatix.home.rakhesh.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <94136a2c0801220259x1b7dd4efw7a8fc1e8a60d2cc9@mail.gmail.com> <20080122202158.R45709@dogmatix.home.rakhesh.com> <94136a2c0801220845w6bbf50c9q7ba59052c72e871d@mail.gmail.com> <20080122211202.Q45709@dogmatix.home.rakhesh.com> Cc: freebsd-questions@freebsd.org Subject: Re: pflogd log X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2008 17:45:32 -0000 Hello, 2008/1/22, Rakhesh Sasidharan : > Zbigniew Szalbot wrote: > > > Hello, > > > > 2008/1/22, Rakhesh Sasidharan : > >> > >>> I noticed that pflog is not being written to. > >>> > >>> $ l /var/log/pflog > >>> -rw-r--r-- 1 root wheel 60 Jan 22 00:00 /var/log/pflog > >>> > >>> However, the process running pflogd runs as _pflogd. Does this mean I > >>> should chown the log file with user _pflogd? > >> > >> I don't think so. Had a look at my machine, /var/log/pflog has permissions > >> like on yours. > >> > >>> _pflogd 248 0.0 0.2 1632 1056 ?? S 6:49AM 0:01.31 > >>> pflogd: [suspended] -s 116 -f /var/log/pflog (pflogd) > >>> > >>> To complete the picture: > >>> > >>> $ ps aux |grep pf > >>> root 36 0.0 0.0 0 8 ?? DL 6:49AM 0:01.04 [softdepflush] > >>> root 246 0.0 0.2 1568 1004 ?? Is 6:49AM 0:00.01 > >>> pflogd: [priv] (pflogd) > >>> _pflogd 248 0.0 0.2 1632 1056 ?? S 6:49AM 0:01.32 > >>> pflogd: [suspended] -s 116 -f /var/log/pflog (pflogd) > >> > >> I don't have pflogd: [suspended] though. Its pflogd: [running] for me. > >> Have you tried restart /etc/rc.d/pflog? > > > > Thanks! Need to find out what is going on. Have restarted pflogd but > > it is still showing suspend for me. > > Try sending the pflogd process a HUP or ALRM signal. That should do the > trick. Funny how I missed it the first time, but I had a look at the > pflogd(8) manpage once again and it talks about this problem. > > This is the para just above the options section. > > Let me know how it goes. > > Also, just noticed now that my /var/log/pflog file doesn't have read perms > for the others group. Would suggest removing that and trying again. > Possible the extra perms are an issue. I do not know. l /var/log/pflog -rw------- 1 root wheel 60 Jan 22 00:00 /var/log/pflog $ ps ax |grep pflog 25478 ?? Is 0:00.01 pflogd: [priv] (pflogd) 25479 ?? S 0:00.03 pflogd: [suspended] -s 116 -f /var/log/pflog (pflogd) 25561 p0 S+ 0:00.01 grep pflog Not really sure what is going on. I tried: kill -HUP 25479 but to no avail. Thanks! Zbigniew Szalbot