proposal for update to pf logging FAQ

Lars Toft Jacobsen <[email protected]>
Newsgroups gmane.os.openbsd.www
Message-ID <[email protected]>
Hello Guys,

The page http://www.openbsd.org/faq/pf/logging.html has a section named "Packet Logging Through Syslog" containing an example script pflogrotate. This is a great example, however it won't work with OpenBSD 4.7. The problem is that pflogd no longer has a .pid file in /var/run as indicated in the script. I will suggest that the pkill style signalling (used also in /etc/newsyslog.conf) is used instead. That way the script will read:

/etc/pflogrotate (for 4.7)

	#!/bin/sh
	PFLOG=/var/log/pflog
	FILE=/var/log/pflog5min.$(date "+%Y%m%d%H%M")
	pkill -ALRM -u root -U root -t - -x pflogd
	if [ -r $PFLOG ] && [ $(stat -f %z $PFLOG) -gt 24 ]; then
	   mv $PFLOG $FILE
	   pkill -HUP -u root -U root -t - -x pflogd
	   tcpdump -n -e -ttt -r $FILE | logger -t pf -p local0.info
	   rm $FILE
	fi

Thank you so much for a truly great OS.

Sincerely,
Lars Toft Jacobsen, Denmark
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.