cpghost <[EMAIL PROTECTED]> wrote: > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > This won't work: > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > because tail doesn't start at the right location.
[...] > I'm afraid that in the latter case, every packet will be > EITHER logged by pflogd > XOR displayed by tcpdump. > Is that so? > > If yes, /var/log/pflog would be incomplete, because some packets > would have been snatched away from pflog0 by tcpdump, before > pflogd ever got a chance to read them out. > > Is there a way to watch /var/log/pflog grow, while > still making sure that pflogd logs EVERY packet that appears > on the pflog0 interface? How? According to pflogd(8): Display the logs in real time (this does not interfere with the operation of pflogd): # tcpdump -n -e -ttt -i pflog0 -- Sahil Tandon <[EMAIL PROTECTED]> _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"