I have pf configured and working with rule sets that are logged.

Where is pf logging to? How do I check these logs? How do I configure them?


Packet filter doesn't log on any file. It does log on a network interface named pflog0 (a special device in Unix-lang), see

man pf.conf

You turn on this interface with:

ifconfig pflog0 create

You suppress it with:

ifconfig pflog0 destroy

You can follow what does packet filter logs on this interface with tcpdump or wireshark.

| improve this answer | |

Generally the PF log file would be stored in:


to tcpdump for example you might do:

tcpdump -n -e -ttt -i pflog1

for more info do:

man pflog
| improve this answer | |
  • I checked var log not there. I don't have that interface I am comfortable with that tcpdump command ; I do have a dev pf I'm not sure if that's related ; – James Nov 17 '13 at 2:14
  • No wait damit it's osx 10.9 I forgot something I knew it – James Nov 17 '13 at 2:22
  • BTW — you might be interested in this nice/simple frontend for PFLists – l'L'l Nov 17 '13 at 3:45
  • I dear god more bash script bombs hey you shady fellow I need cs13 do you have a copy – James Nov 17 '13 at 4:21

For macOS 10.12 the tcpdump command for the logs appears to be broken. Wireshark can be used or Pfloggerd see https://discussions.apple.com/thread/7905793

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .