I have pf configured and working with rule sets that are logged.
Where is pf logging to? How do I check these logs? How do I configure them?
Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.Sign up to join this community
Packet filter doesn't log on any file. It does log on a network interface named
pflog0 (a special device in Unix-lang), see
You turn on this interface with:
ifconfig pflog0 create
You suppress it with:
ifconfig pflog0 destroy
You can follow what does packet filter logs on this interface with
Generally the PF log file would be stored in:
to tcpdump for example you might do:
tcpdump -n -e -ttt -i pflog1
for more info do:
For macOS 10.12 the tcpdump command for the logs appears to be broken. Wireshark can be used or Pfloggerd see https://discussions.apple.com/thread/7905793