OpenBSD PF - Logging [Contents]


When a packet is logged by PF, a copy of the packet header is sent to a pflog(4) interface along with some additional data such as the interface the packet was transiting, the action that PF took (pass or block), etc. The pflog(4) interface allows user-space applications to receive PF's logging data from the kernel. If PF is enabled when the system is booted, the pflogd(8) daemon is started. By default, pflogd(8) listens on the pflog0 interface and writes all logged data to the /var/log/pflog file.

Logging packets

In order to log packets passing through PF, the log keyword must be used. The log keyword causes all packets that match the rule to be logged. In the case where the rule is creating state, only the first packet seen (the one that causes the state to be created) will be logged.

The options that can be given to the log keyword are:

Causes all matching packets, not just the initial packet, to be logged. Useful for rules that create state.
to pflogN
Causes all matching packets to be logged to the specified pflog(4) interface. For example, when using spamlogd(8), all SMTP traffic can be logged to a dedicated pflog(4) interface by PF. The spamlogd(8) daemon can then be told to listen on that interface. This keeps the main PF logfile clean of SMTP traffic which otherwise would not need to be logged. Use ifconfig(8) to create pflog(4) interfaces. The default log interface pflog0 is created automatically.
Causes the user id and group id that owns the socket that the packet is sourced from/destined to (whichever socket is local) to be logged along with the standard log information.
Options are given in parenthesis after the log keyword; multiple options can be separated by a comma or space.
pass in log (all, to pflog1) on egress inet proto tcp to egress port 22

Reading a log file

The log file written by pflogd is in binary format and cannot be read using a text editor. tcpdump(8) must be used instead.

To view the log file:

# tcpdump -n -e -ttt -r /var/log/pflog
Note that using tcpdump(8) to watch the pflog file does not give a real-time display. A real-time display of logged packets is achieved by using the pflog0 interface:
# tcpdump -n -e -ttt -i pflog0
NOTE: When examining the logs, special care should be taken with tcpdump's verbose protocol decoding (activated via the -v command line option). tcpdump's protocol decoders do not have a perfect security history. At least in theory, a delayed attack could be possible via the partial packet payloads recorded by the logging device. It is recommended practice to move the log files off of the firewall machine before examining them in this way.

Additional care should also be taken to secure access to the logs. By default, pflogd will record 160 bytes of the packet in the log file. Access to the logs could provide partial access to sensitive packet payloads.

Filtering log output

Because pflogd logs in tcpdump binary format, the full range of tcpdump features can be used when reviewing the logs. For example, to only see packets that match a certain port:
# tcpdump -n -e -ttt -r /var/log/pflog port 80
This can be further refined by limiting the display of packets to a certain host and port combination:
# tcpdump -n -e -ttt -r /var/log/pflog port 80 and host
The same idea can be applied when reading from the pflog0 interface:
# tcpdump -n -e -ttt -i pflog0 host
Note that this has no impact on which packets are logged to the pflogd log file; the above commands only display packets as they are being logged.

In addition to using the standard tcpdump(8) filter rules, the tcpdump filter language has been extended for reading pflogd output:

# tcpdump -n -e -ttt -i pflog0 inbound and action block and on wi0
This display the log, in real-time, of inbound packets that were blocked on the wi0 interface.

Packet logging through syslog

In many situations it is desirable to have the firewall logs available in ASCII format and/or to send them to a remote logging server. All this can be accomplished with a small shell script, some minor changes of the OpenBSD configuration files, and syslogd(8), the logging daemon. syslogd logs in ASCII and is also able to log to a remote logging server.

Create the following script as /etc/pflogrotate.

FILE=/var/log/pflog5min.$(date "+%Y%m%d%H%M")

pkill -ALRM -u root -U root -t - -x pflogd
if [ -r $PFLOG ] && [ $(stat -f %z $PFLOG) -gt 24 ]; then
   mv $PFLOG $FILE
   pkill -HUP -u root -U root -t - -x pflogd
   tcpdump -n -e -s 160 -ttt -r $FILE | logger -t pf -p
   rm $FILE
Edit root's cron table:
# crontab -u root -e
Add the following two lines:
# rotate pf log file every 5 minutes
0-59/5 *       *       *       *       /bin/sh /etc/pflogrotate
Add the following line to /etc/syslog.conf:     /var/log/pflog.txt
If you also want to log to a remote log server, add the line:     @syslogger
Make sure host syslogger has been defined in the hosts(5) file.

Create the file /var/log/pflog.txt to allow syslog to log to that file, and give it the same permissions as the pflog file.

# touch /var/log/pflog.txt
# chmod 600 /var/log/pflog.txt
Make syslogd notice the changes by restarting it:
# kill -HUP $(cat /var/run/
All logged packets are now sent to /var/log/pflog.txt. If the second line is added, they are sent to the remote logging host syslogger as well.

The script /etc/pflogrotate now processes and then deletes /var/log/pflog so rotation of pflog by newsyslog(8) is no longer necessary and should be disabled. However, /var/log/pflog.txt replaces /var/log/pflog and rotation of it should be activated. Change /etc/newsyslog.conf as follows:

#/var/log/pflog       600    3    250    *    ZB "pkill -HUP -u root -U root -t - -x pflogd"
/var/log/pflog.txt    600    7    *      24
PF will now log in ASCII to /var/log/pflog.txt. If so configured in /etc/syslog.conf, it will also log to a remote server. The logging is not immediate but it can take up to about 5-6 minutes (the cron job interval) before the logged packets appear in the file.