Date: Wed, 5 Nov 2008 06:27:11 +0100 From: cpghost <cpghost@cordula.ws> To: freebsd-questions@freebsd.org Subject: Re: Watching /var/log/pflog grow Message-ID: <20081105052710.GD2277@epia-2.farid-hajji.net> In-Reply-To: <20081105022242.GA1178@shepherd> References: <20081104191354.GA1819@phenom.cordula.ws> <20081105022242.GA1178@shepherd>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 04, 2008 at 09:22:42PM -0500, Sahil Tandon wrote: > cpghost <cpghost@cordula.ws> wrote: > > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn't start at the right location. > > [...] > > > I'm afraid that in the latter case, every packet will be > > EITHER logged by pflogd > > XOR displayed by tcpdump. > > Is that so? > > > > If yes, /var/log/pflog would be incomplete, because some packets > > would have been snatched away from pflog0 by tcpdump, before > > pflogd ever got a chance to read them out. > > > > Is there a way to watch /var/log/pflog grow, while > > still making sure that pflogd logs EVERY packet that appears > > on the pflog0 interface? How? > > According to pflogd(8): > > Display the logs in real time (this does not interfere with the > operation of pflogd): > > # tcpdump -n -e -ttt -i pflog0 EOUTOFCAFFEINE I actually read the man page, but I didn't pay attention to this. Sorry for the noise and thanks for pointing it out. -cpghost. -- Cordula's Web. http://www.cordula.ws/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081105052710.GD2277>