proposal for update to pf logging FAQ
Lars Toft Jacobsen <[email protected]>
| Newsgroups | gmane.os.openbsd.www |
|---|---|
| Message-ID | <[email protected]> |
Hello Guys, The page http://www.openbsd.org/faq/pf/logging.html has a section named "Packet Logging Through Syslog" containing an example script pflogrotate. This is a great example, however it won't work with OpenBSD 4.7. The problem is that pflogd no longer has a .pid file in /var/run as indicated in the script. I will suggest that the pkill style signalling (used also in /etc/newsyslog.conf) is used instead. That way the script will read: /etc/pflogrotate (for 4.7) #!/bin/sh PFLOG=/var/log/pflog FILE=/var/log/pflog5min.$(date "+%Y%m%d%H%M") pkill -ALRM -u root -U root -t - -x pflogd if [ -r $PFLOG ] && [ $(stat -f %z $PFLOG) -gt 24 ]; then mv $PFLOG $FILE pkill -HUP -u root -U root -t - -x pflogd tcpdump -n -e -ttt -r $FILE | logger -t pf -p local0.info rm $FILE fi Thank you so much for a truly great OS. Sincerely, Lars Toft Jacobsen, Denmark