Re: [List] pf log files

On 24/07/2026 09:17, Doug Hardie wrote:
> pf is logging as directed in pf.conf.  it creates the file pflog in /var/log.  However, there are a bunch of pflog.bad.nnnnnnn files where the n's appear to be random characters.  Each of them has only one line like:
>
> Jul 20 00:00:00 mail newsyslog[69857]: logfile turned over
>
> There is no pflog.bad entry in /etc/newsyslog.conf  The conf.d entry in newsyslog.conf is commented out.  What is generating these files?  Can it be disabled?
>
Donno, but I can guess, as usual.

I don't think syslog or pf is creating them; newsyslog is.

Can you run this:

newsyslog -nrv

It'll list all the stuff newsyslog is going to do from all the config files.

Now my guess is that newsyslog is rotating /var/log/pflog every night 
using the wrong flags. On my system (in front of me) its in 
/etc/newsyslog.conf.d/pf.conf and the line looks like this:

/var/log/pflog                          600  3     1000 *     JB   
/var/run/pflogd.pid

Note the 'B' flag - it's important because it's telling it it's a binary 
file. If it's a text file newsyslog will add a line saying it's been 
turned over, very much as you describe. I think you'll find B is missing 
somewhere.

End of Part 1

So where are the .bad. files coming from?

When the file is rotated it will send a SIG to restart pflogd, which 
will go to it's log file and discover it's no longer a pcap file. Rather 
than clobber it completely, it renames it using a function mkstemp() 
looking at the format of the .bad file, and create a new pflog binary 
file to log to.

End of Part 2

Well that's my theory. What I can't tell you is where the bad entry is 
coming from. Perhaps it's defaulted to something else if you've 
commented out the correct entry in /etc/newsyslog.conf.d/pf.conf ?

So let's see the output of newsyslog -nrv ? And perhaps also:

grep -n pflog /etc/newsyslog.conf /etc/newsyslog.conf.d/*.conf 
/usr/local/etc/newsyslog.conf.d/*.conf

Regards, Frank.