Re: [List] pf log files

> On Jul 24, 2026, at 14:41, Frank Leonhardt <[email protected]> =
wrote:
>=20
> On 24/07/2026 09:17, Doug Hardie wrote:
>> pf is logging as directed in pf.conf.  it creates the file pflog in =
/var/log.  However, there are a bunch of pflog.bad.nnnnnnn files where =
the n's appear to be random characters.  Each of them has only one line =
like:
>>=20
>> Jul 20 00:00:00 mail newsyslog[69857]: logfile turned over
>>=20
>> There is no pflog.bad entry in /etc/newsyslog.conf  The conf.d entry =
in newsyslog.conf is commented out.  What is generating these files?  =
Can it be disabled?
>>=20
> Donno, but I can guess, as usual.
>=20
> I don't think syslog or pf is creating them; newsyslog is.
>=20
> Can you run this:
>=20
> newsyslog -nrv
>=20
> It'll list all the stuff newsyslog is going to do from all the config =
files.
>=20
> Now my guess is that newsyslog is rotating /var/log/pflog every night =
using the wrong flags. On my system (in front of me) its in =
/etc/newsyslog.conf.d/pf.conf and the line looks like this:
>=20
> /var/log/pflog                          600  3     1000 *     JB   =
/var/run/pflogd.pid
>=20
> Note the 'B' flag - it's important because it's telling it it's a =
binary file. If it's a text file newsyslog will add a line saying it's =
been turned over, very much as you describe. I think you'll find B is =
missing somewhere.
>=20
> End of Part 1
>=20
> So where are the .bad. files coming from?
>=20
> When the file is rotated it will send a SIG to restart pflogd, which =
will go to it's log file and discover it's no longer a pcap file. Rather =
than clobber it completely, it renames it using a function mkstemp() =
looking at the format of the .bad file, and create a new pflog binary =
file to log to.

Digging through pflogd source, I find that is exactly what is happening. =
 I don't see any easy way to prevent that without compromising the =
functioning of other log files.  I guess I will need to daily prune =
those files as they serve no useful purpose.

>=20
> End of Part 2
>=20
> Well that's my theory. What I can't tell you is where the bad entry is =
coming from. Perhaps it's defaulted to something else if you've =
commented out the correct entry in /etc/newsyslog.conf.d/pf.conf ?
>=20
> So let's see the output of newsyslog -nrv ? And perhaps also:
>=20
> grep -n pflog /etc/newsyslog.conf /etc/newsyslog.conf.d/*.conf =
/usr/local/etc/newsyslog.conf.d/*.conf
>=20
> Regards, Frank.


mail# newsyslog -nrv
Processing /etc/newsyslog.conf
Found: <include> /usr/local/etc/newsyslog.conf.d/[!.]*.conf
/var/log/auth.log <7Z>: --> will trim at Thu Dec 31 23:00:00 2026
/var/log/console.log <5Z>: size (Kb): 51 [100] --> skipping
/var/log/cron <3Z>: size (Kb): 99 [100] --> skipping
/var/log/daily.log <7Z>: does not exist, skipped.
/var/log/debug.log <7Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/maillog <21Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/maillist <32Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/imaplog <21Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/messages <5Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/monthly.log <12Z>: does not exist, skipped.
/var/log/pflog <3Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/ppp.log <3Z>: size (Kb): 0 [100] --> skipping
/var/log/security <10Z>: size (Kb): 0 [100] --> skipping
/var/log/sendmail.st <10>: does not exist, skipped.
/var/log/daemon.log <5Z>: --> will trim at Sat Jul 25 00:00:00 2026
/var/log/utx.log <3>: --> will trim at Sat Aug  1 05:00:00 2026
/var/log/weekly.log <5Z>: does not exist, skipped.
/var/log/xferlog <7Z>: size (Kb): 1 [100] --> skipping
mail#=20

mail# grep -n pflog /etc/newsyslog.conf /etc/newsyslog.conf.d/*.conf =
/usr/local/etc/newsyslog.conf.d/*.conf
/etc/newsyslog.conf:27:/var/log/pflog				600  3	 =
  *	@T00     ZC    /var/run/pflogd.pid
/etc/newsyslog.conf.d/pf.conf:1:/var/log/pflog				=
600  3	   1000	*     JB    /var/run/pflogd.pid
mail#=20


However, note that /etc/newsyslog.conf has at the end:

#<include> /etc/newsyslog.conf.d/[!.]*.conf
<include> /usr/local/etc/newsyslog.conf.d/[!.]*.conf


/usr/local/etc/newsyslog.conf.d does not exist.