Re: pf working but no log

2006-11-07 Thread Giorgos Keramidas
On 2006-11-07 08:53, Zbigniew Szalbot [EMAIL PROTECTED] wrote: On Tue, 7 Nov 2006, Giorgos Keramidas wrote: No, that should be ok. Can you see pflogd running when you run: # pgrep pflogd | xargs ps -xau -p No, and now when I think about it the main problem is that it has never been

Re: pf working but no log

2006-11-07 Thread Zbigniew Szalbot
Dear Giorgos, Juha and others, On Tue, 7 Nov 2006, Giorgos Keramidas wrote: No, and now when I think about it the main problem is that it has never been started (maybe). I tried to follow the manual and issued /etc/rc.d/pflogd start but I have no such file in that directory. Hmmm, this is

Re: pf working but no log

2006-11-07 Thread Juha Saarinen
On 11/7/06, Zbigniew Szalbot [EMAIL PROTECTED] wrote: How do I create the pflog file then? Thank you! As far as I know, you don't need to create it yourself. I certainly didn't have to do that. If you look at man pflogd it says the daemon logs to /var/log/pflog by default. That it doesn't on

pf working but no log

2006-11-06 Thread Zbigniew Szalbot
Hello, I configured the pf utility on FBSD 6.1 stable. I put in a very simple rule to test: block in log on $ext_if proto tcp from 218.83.108.230 to any port 25 Now, my conf file specifies that logging should be done to /var/log/ipfilter.log But it is not happening although I tested it by

Re: pf working but no log

2006-11-06 Thread Giorgos Keramidas
On 2006-11-06 19:40, Zbigniew Szalbot [EMAIL PROTECTED] wrote: Hello, I configured the pf utility on FBSD 6.1 stable. I put in a very simple rule to test: block in log on $ext_if proto tcp from 218.83.108.230 to any port 25 Now, my conf file specifies that logging should be done to

Re: pf working but no log

2006-11-06 Thread Zbigniew Szalbot
Hello, On Mon, 6 Nov 2006, Giorgos Keramidas wrote: I think there's a slight misunderstanding here. PF is *not* ipfilter, so unless you've done something special it doesn't log to ipfilter.log. Can you show us the exact rc.conf settings you used for PF? Acutally I made a typo when writting

Re: pf working but no log

2006-11-06 Thread Giorgos Keramidas
On 2006-11-06 22:57, Zbigniew Szalbot [EMAIL PROTECTED] wrote: On Mon, 6 Nov 2006, Giorgos Keramidas wrote: I think there's a slight misunderstanding here. PF is *not* ipfilter, so unless you've done something special it doesn't log to ipfilter.log. Can you show us the exact rc.conf

Re: pf working but no log

2006-11-06 Thread Zbigniew Szalbot
Hello again, On Tue, 7 Nov 2006, Giorgos Keramidas wrote: * Have you restarted it at all, after the configuration options were set? I believe I did by running /etc/rc.d/pf stop/start. Starting/stopping has no efect on pflog file in terms of changing its modification time time. * Does

Re: pf working but no log

2006-11-06 Thread Juha Saarinen
On 11/7/06, Zbigniew Szalbot [EMAIL PROTECTED] wrote: -rw-r--r-- 1 root wheel - 0 Nov 6 19:24 /var/log/pflog I created the file by using touch command. Thanks! That file should be a pcap file: $ sudo file /var/log/pflog /var/log/pflog: tcpdump capture file (little-endian) - version 2.4

Re: pf working but no log

2006-11-06 Thread Zbigniew Szalbot
Hello, On Tue, 7 Nov 2006, Juha Saarinen wrote: That file should be a pcap file: Maybe that's the problem then - that I created it using touch? $ sudo file /var/log/pflog I only get: /var/log/pflog: empty What do you see if you do: $sudo /etc/rc.d/pf status No ALTQ support in

Re: pf working but no log

2006-11-06 Thread Giorgos Keramidas
On 2006-11-07 07:57, Zbigniew Szalbot [EMAIL PROTECTED] wrote: On Tue, 7 Nov 2006, Juha Saarinen wrote: That file should be a pcap file: Maybe that's the problem then - that I created it using touch? No, that should be ok. Can you see pflogd running when you run: # pgrep pflogd | xargs

Re: pf working but no log

2006-11-06 Thread Zbigniew Szalbot
Hello again, On Tue, 7 Nov 2006, Giorgos Keramidas wrote: No, that should be ok. Can you see pflogd running when you run: # pgrep pflogd | xargs ps -xau -p No, and now when I think about it the main problem is that it has never been started (maybe). I tried to follow the manual and