On Tue, Nov 04, 2008 at 09:22:42PM -0500, Sahil Tandon wrote: > cpghost <[EMAIL PROTECTED]> wrote: > > > How can I watch /var/log/pflog grow with tcpdump, "tail -f" style? > > > > This won't work: > > $ tail -f /var/log/pflog | tcpdump -n -s 116 -r - > > because tail doesn't start at the right location. > > [...] > > > I'm afraid that in the latter case, every packet will be > > EITHER logged by pflogd > > XOR displayed by tcpdump. > > Is that so? > > > > If yes, /var/log/pflog would be incomplete, because some packets > > would have been snatched away from pflog0 by tcpdump, before > > pflogd ever got a chance to read them out. > > > > Is there a way to watch /var/log/pflog grow, while > > still making sure that pflogd logs EVERY packet that appears > > on the pflog0 interface? How? > > According to pflogd(8): > > Display the logs in real time (this does not interfere with the > operation of pflogd): > > # tcpdump -n -e -ttt -i pflog0
EOUTOFCAFFEINE I actually read the man page, but I didn't pay attention to this. Sorry for the noise and thanks for pointing it out. -cpghost. -- Cordula's Web. http://www.cordula.ws/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
