Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 05:15:57PM -0800, Jeremy Chadwick wrote: > On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 09:22:42PM -0500, Sahil Tandon wrote: > cpghost <[EMAIL PROTECTED]> wrote: > > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 1

Re: Watching /var/log/pflog grow

2008-11-04 Thread cpghost
On Tue, Nov 04, 2008 at 07:20:42PM +, Matthew Seaman wrote: > cpghost wrote: > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > >

Re: Watching /var/log/pflog grow

2008-11-04 Thread Sahil Tandon
cpghost <[EMAIL PROTECTED]> wrote: > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > This won't work: > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > because tail doesn't start at the right location. [...] > I'm

Re: Watching /var/log/pflog grow

2008-11-04 Thread Jeremy Chadwick
On Tue, Nov 04, 2008 at 08:13:54PM +0100, cpghost wrote: > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > This won't work: > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > because tail doesn't start at the right location. >

Watching /var/log/pflog grow

2008-11-04 Thread cpghost
How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the captured packets a

Re: Watching /var/log/pflog grow

2008-11-04 Thread Matthew Seaman
cpghost wrote: How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? This won't work: $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - because tail doesn't start at the right location. Using a blocksize (-b) with tail may also not be right, because the capt

Re: pflog

2006-05-22 Thread Albert Shih
Le 22/05/2006 à 10:14:58-0400, Andy Greenwood a écrit > This is discussed in the openbsd pf page > > http://www.openbsd.org/faq/pf/logging.html#syslog > Thanks for the URLbut it's seem the shell script write on FILE=/home/pflogger/pflog5min.$(date "+%Y%m%d%H%M") first before he pus

Re: pflog

2006-05-22 Thread Andy Greenwood
e your rules, you put "log" in them.. > > > example: > pass in quick log proto tcp from any to any keep state > > > then you have to have pflogd started(pflog_enable="YES" in /etc/rc.conf). > > When pflog is started your binary log is lcated on /var/l

Re: pflog

2006-05-22 Thread Albert Shih
n you have to have pflogd started(pflog_enable="YES" in /etc/rc.conf). > > When pflog is started your binary log is lcated on /var/log/pflog > > you can read it witH: > tcpdump -n -t -r /var/log/pflog > > if you want real time(because pflog is where is written wi

Re: pflog

2006-05-22 Thread Iantcho Vassilev
On 5/22/06, Albert Shih <[EMAIL PROTECTED]> wrote: Hi all I want to use pf (actually I use ipfw). Well after I read the openbsd book, I always don't known how can I log the log of pf (with pflog) using syslog and I don't want (if it's possible) to write anything in my

pflog

2006-05-22 Thread Albert Shih
Hi all I want to use pf (actually I use ipfw). Well after I read the openbsd book, I always don't known how can I log the log of pf (with pflog) using syslog and I don't want (if it's possible) to write anything in my hard-disk (event it's temporaly, because it's virtual

Re: pflog summary script?

2005-11-24 Thread Giorgos Keramidas
On 2005-11-24 19:33, JD Bronson <[EMAIL PROTECTED]> wrote: > Does anyone have a simple shell/perl script that can take > /var/log/pflog and parse it into a simple txt or html? > > I would like to cron a script that can clean up the output of pflog > and put it into so

pflog summary script?

2005-11-24 Thread JD Bronson
Does anyone have a simple shell/perl script that can take /var/log/pflog and parse it into a simple txt or html? I would like to cron a script that can clean up the output of pflog and put it into something more readable... Basically something that looks like: Time - SourceIP - Destination

Re: pflog trouble?

2005-11-14 Thread dick hoogendijk
tes to > > complete the shutdown process. The machine "seemed to hang" on the > > shutdown of the pflog device. The porcess /was/ completed > > succesfully in the end but I wonder what happened.. > > > > After starting up again and (again) a shutdown -p n

Re: pflog trouble?

2005-11-14 Thread Lowell Gilbert
Dick Hoogendijk <[EMAIL PROTECTED]> writes: > Today I compiled some kde stuff for a few hours on my fbsd-6.0 box and > when I gave the "shutdown -p now" command it took minutes to complete > the shutdown process. The machine "seemed to hang" on the shutdown of &

pflog trouble?

2005-11-12 Thread Dick Hoogendijk
Today I compiled some kde stuff for a few hours on my fbsd-6.0 box and when I gave the "shutdown -p now" command it took minutes to complete the shutdown process. The machine "seemed to hang" on the shutdown of the pflog device. The porcess /was/ completed succesfully in the e