> Yes, one could log stuff into different pflog interfaces, but I don't > understand why pf.conf `pass in ... log ... port smtp ...` is effectively > redefined to mean `add <spamd-white>` when spamlogd is running,
http://www.openbsd.org/cgi-bin/man.cgi?query=spamlogd and RTFM for the first two sentences - and it's pretty darn clear. Those of us that whitelist blocks of addresses (and log them) like this behaviour to track what mailservers we are seeing like the current behavior.