Re: Turning on pf logging after switching from ipf.

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Thu, Feb 28, 2002 at 10:09:01AM -0800, Shawn Wilton wrote:

> Thanks!  but why isn't that in the man pages and why isn't it done
> automatically?  Is there a way of logging to disk w/o the risk of running
> tcpdump as root on the base machine?

It is in the man page, pflogd(8). And if you have (manually) updated
your /etc, rc will automatically start pflogd, which logs to
/var/log/pflog, which you can tcpdump as non-root, if you chmod it
appropriately. tcpdump'ing pflog0 is just for additional life dumping of
the same packets that already get loggin in /var/log/pflog.

Daniel