Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# Logging

Keyword "log" in the rules to be logged

`/etc/pf.conf`

    pass out log from <client> to any port $email \
         label client-email keep state

Logs in binary, tcpdump(8) readable format

NOTE: `log` logs only initial packet, use `log (all)` to log all matching packets

OpenBSD 4.1 onwards: cloneable `pflog`, rules can log to specific interface:

    pass log (all, to pflog2) inet proto tcp from $mailserver \
         to any port smtp

`pflog` interfaces created with ifconfig `pflogN create`