RE: [fwAnalog] Logs are empty on FreeBSD 4.7 Release

From: Adam Lofstedt (
Date: Mon Dec 30 2002 - 20:36:33 CET

> Hello,
> * Adam Lofstedt <> [2002-12-26 23:47]:
> > It looks like ipmon is logging the blocked packets correctly to the
> > file /var/log/ipflog. I am not sure why fwanalog results
> are empty.
> > Can
> Does the following command print any lines?
> egrep -h " -> .+ PR.+len" /var/log/ipflog

This printed out the entries in my log file.

> Also, has the user you are running fwanalog as read
> permissions on the ipflog file?

Yes. Root is the user and has appropriate permissions.

I have since changed how I log the packets so that I am now using syslog and am rotating the logs. Instead of getting zero results, all the results are reported as corrupted.

Here is the part from rc.conf:

Here is from syslog.cong:
Local0.* /var/log/firewall_logs

Here is my fwanalog.opts file:

I am using the "ipf" logformat in the opts file. I have tried to log also with:


...which should resolve host names and log some other things about TCP packets, but it also returned corrupted results. Is there something else I need to do to get this to work?


This archive was generated by hypermail 2.1.5 : Tue Dec 31 2002 - 11:22:02 CET