I am runing FreeBSD 8 stable with PF as firewall, I am looking for any tool for parsing PF log's.
Does this help:
The log file written by pflogd is in binary format and cannot be read using a text editor. Tcpdump must be used to view the log.
To view the log file:
# tcpdump -n -e -ttt -r /var/log/pflog
other useful info here
-
I am looking for some thing built with perl or C, some thing give statics, show time, and highlight issues(for scanning for example), with structured format like tables. – SIFE May 29 '11 at 15:36
How about Splunk? It processes any machine data and gives ability to do all sorts of acrobatics with it.
There is in fact a very useful tool for pf real-time information and limited statistics: sysutils/pftop
As the name already suggests, it works much like the top utility.
