svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
pflogd(8)
is a background daemon which reads packets logged by to a dedi‐
cated capture link interface (see for details), normally and
writes the packets to a logfile (normally in libpcap format (see
for details). These logs can be reviewed later using the option
of hopefully offline in case there are bugs in the packet parsing
code of
closes and then re-opens the log file when it receives permitting
convenient log rotation. causes to flush the current logfile
buffers to the disk, thus making the most recent logs available.
The buffers are also flushed every seconds. If the log file con‐
tains data after a restart or a new logs are appended to the ex‐
isting file. If the existing log file was created with a differ‐
ent snaplen, temporarily uses the old snaplen to keep the log
file consistent. tries to preserve the integrity of the log file
against I/O errors. Furthermore, integrity of an existing log
file is verified before appending. If there is an invalid log
file or an I/O error, the log file is moved out of the way and a
new one is created. If a new file cannot be created, logging is
suspended until a or a is received. will also log the pcap sta‐
tistics for the capture link interface to syslog when a is re‐
ceived. The options are as follows: Creates a new instance with
the specified name. If additional options are used to specify
configuration, it is stored into the repository. Default values
are used for properties unless overriden by a command-line op‐
tion. The exception is pflog/interface (set to equal the instance
name) and pflog/logfile (set to a file with name equal to the in‐
stance name followed by the extension located inside the direc‐
tory) if the service instance name forms a valid linkname. If the
service instance name is not a valid linkname, the values must be
given explicitly. Shows/changes the configuration of the given
instance in repository. Attributes specified by additional op‐
tions are placed into the repository. Time in seconds to delay
between automatic flushes of the file. This may be specified
with a value between 5 and 3600 seconds. If not specified, the
default is 60 seconds. Log output filename. When neither nor is
used, the default value is used. Specifies the capture link in‐
terface to use. When neither nor is used, the default value is
assumed. Analyze at most the first bytes of data from each
packet rather than the default of 160. The default of 160 is ad‐
equate for IP, ICMP, TCP, and UDP headers but may truncate proto‐
col information for other protocols. Other file parsers may de‐
sire a higher snaplen. Selects which packets will be dumped, us‐
ing the regular language of Tcpdump has been extended to be able
to filter on the pfloghdr structure defined in It can restrict
the output to packets logged on a specified interface, a rule
number, a reason, a direction, an IP family or an action. Ad‐
dress family equals IPv4. Address family equals IPv6. Interface
name equals "kue0". Interface name equals "kue0". Ruleset name
equals "authpf". Rule number equals 10. Reason equals match.
Also accepts "bad-offset", "fragment", "short", "normalize",
"memory", "bad-timestamp", "congestion", "ip-option", "proto-ck‐
sum", "state-mismatch", "state-insert", "state-limit", "src-
limit", and "synproxy". Action equals pass. Also accepts
"block" and "match". The direction was inbound. The direction
was outbound. The daemon must be started as an service with the
following FMRI: svc:/network/firewall/pflog Command line options
described above are set via the following properties. Automatic
flush interval. The default value is 60. Used as the argument
for the option. Packet filter expression in format. No expres‐
sion is defined by default. The capture link name from which to
read packets. Used as the argument for the option. Path to the
logfile (for security reasons, only paths starting by the direc‐
tory are allowed. Used as the argument for the option. An upper
bound on how many bytes from each packet to analyze. The default
value is 160. Used as the argument for the option. The start
method creates a (temporal) capture link the particular instance
is using. The refresh method sends to owned by particular ser‐
vice instance. Log specific TCP packets to a different log file
with a large snaplen (useful with a rule to dump complete ses‐
sions): # pflogd -s 1600 -f suspicious.log port 80 and host evil‐
host Log from another capture link interface, excluding specific
packets: # pflogd -i pflog3 -f network3.log "not (tcp and port
23)" Display binary logs: # tcpdump -n -e -ttt -r /var/log/fire‐
wall/pflog/pflog3.pkt Display the logs in real time (this does
not interfere with the operation of # tcpdump -n -e -ttt -i
pflog0 Display the logs in real time of inbound packets that were
blocked on the wi0 interface: # tcpdump -n -e -ttt -i pflog0 in‐
bound and action block and on wi0 The daemon is a privilege-aware
application which runs as the user possessing privilege that is
required for using to read packets. See for details. The service
start method uses to create capture link if it does not exist al‐
ready. To configure the service one has to obtain the authoriza‐
tion. To manage the service (disable/enable/refresh) one must
have the authorization. Both authorizations are granted through
the Network Firewall Management profile. To create new service
instances, you need the solaris.smf.modify authorization.
See for descriptions of the following attributes:
box; cbp-1 | cbp-1 l | l . ATTRIBUTE TYPE ATTRIBUTE VALUE =
Availability network/firewall/firewall-pflog = Stabil‐
ity Volatile The command appeared in The Solaris version is
based on found in OpenBSD 5.5. was written by
Source code for open source software components in Oracle Solaris
can be found at https://www.oracle.com/downloads/opensource/so‐
laris-source-code-downloads.html.
This software was built from source available at:
https://github.com/oracle/solaris-userland
The original community source was downloaded from:
http://www.openbsd.org/cgi-bin/cvsweb/src/sbin/pflogd/
Further information about this software can be found on the open
source community website at http://www.openbsd.org.