Solved Logging to different files with pf

[quamenzullo]

Hello everyone,

I would like to order a little bit the informations logged by pf(4).

So, I have tried two things:

1. I have added some "(to pflog<n>)" after "log" in the pf(4) rules, like here:

pass log (to pflog2) quick on $ext_if proto tcp from $ssh_authorized_ip to $ext_if port ssh

Problem is, this information is sent to a pflog(4) device. I would like to have them written to some log file.
So, I have added this line in /etc/syslog.conf:

local2.*  /var/log/pflog2.log

(and touched /var/log/pflog2.log).

Restarted syslogd(8), reloaded pf(4) rules.

And tried this: tcpdump -n -tttti pflog2 | logger -p local2.info & in order to have the logs written to /var/log/pflog2.log. But this file remains empty. When I stop the tcpdump(1) process, it shows a short summary about packets:

1 packet captured
1 packet received by filter
0 packets dropped by kernel

2. I have added labels at the end of the rules, like here:

pass log quick on $ext_if proto tcp from $ssh_authorized_ip to $ext_if port ssh label "ssh"

But the labels do not seem to be recorded in /var/log/pflog, or at least I can't find the tcpdump(1) option to display these labels. (I thought the different information could be logged into the same file, but thanks to the labels, it would be possible to grep only some lines?).

So, how should I do to put some order into the information logged by pf(4)? Am I completely wrong trying to use one of these 2 solutions above? How/what do you do?

 

[quamenzullo]

I should maybe add that pflogd is running and that the pflog2 (and sisters) interfaces are up.

 

[quamenzullo]

Well, I found the answer (though I don't understand what was wrong in my attempt with logger).

It's good to read the manual, but better to read the right one! So the answer is in the examples of pflogd(). (Have to run a new instance of pflogd "listening" to the desired interface and redirecting to another log file).