saving records of pf state creation/deletion

[Chris Cappuccio]

is there a tool out there that saves records off pfsync for later analysis?

(my particular case is to figure out who was spamming behind nat, but
i'm sure there are many other uses for something like this)