diff options
author | Jason McIntyre <jmc@cvs.openbsd.org> | 2004-01-16 10:45:50 +0000 |
---|---|---|
committer | Jason McIntyre <jmc@cvs.openbsd.org> | 2004-01-16 10:45:50 +0000 |
commit | 7593331110afc0598e6e59c7758293c74241ee0f (patch) | |
tree | b5b0a1001d082291dfb645c7c5bf42058a8e5065 /sbin/pflogd/pflogd.8 | |
parent | 22cc7dd57960dca93fc90e5fd5bee8f2242b95c0 (diff) |
- standard option order
- sync usage()
- new sentence, new line
- Dv (not Va) for signals
- other nits
ok canacar@
Diffstat (limited to 'sbin/pflogd/pflogd.8')
-rw-r--r-- | sbin/pflogd/pflogd.8 | 40 |
1 files changed, 20 insertions, 20 deletions
diff --git a/sbin/pflogd/pflogd.8 b/sbin/pflogd/pflogd.8 index ed1e50f6914..ac8fe78aa0a 100644 --- a/sbin/pflogd/pflogd.8 +++ b/sbin/pflogd/pflogd.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: pflogd.8,v 1.23 2004/01/15 20:15:14 canacar Exp $ +.\" $OpenBSD: pflogd.8,v 1.24 2004/01/16 10:45:49 jmc Exp $ .\" .\" Copyright (c) 2001 Can Erkin Acar. All rights reserved. .\" @@ -32,11 +32,10 @@ .Nd packet filter logging daemon .Sh SYNOPSIS .Nm pflogd -.Op Fl D +.Op Fl Dx .Op Fl d Ar delay .Op Fl f Ar filename .Op Fl s Ar snaplen -.Op Fl x .Op Ar expression .Sh DESCRIPTION .Nm @@ -58,11 +57,11 @@ hopefully offline in case there are bugs in the packet parsing code of .Pp .Nm closes and then re-opens the log file when it receives -.Va SIGHUP , +.Dv SIGHUP , permitting .Xr newsyslog 8 to rotate logfiles automatically. -.Va SIGALRM +.Dv SIGALRM causes .Nm to flush the current logfile buffers to the disk, thus making the most @@ -72,7 +71,7 @@ The buffers are also flushed every seconds. .Pp If the log file contains data after a restart or a -.Va SIGHUP , +.Dv SIGHUP , new logs are appended to the existing file. If the existing log file was created with a different snaplen, .Nm @@ -81,23 +80,23 @@ temporarily uses the old snaplen to keep the log file consistent. .Nm tries to preserve the integrity of the log file against I/O errors. Furthermore, integrity of an existing log file is verified before -appending. If there is an invalid log file or an I/O error, logging -is suspended, until a -.Va SIGHUP +appending. +If there is an invalid log file or an I/O error, logging is suspended until a +.Dv SIGHUP or a -.Va SIGALRM +.Dv SIGALRM is received. .Pp The options are as follows: .Bl -tag -width Ds -.It Fl d Ar delay -Time in seconds to delay between automatic flushes of the file. -This may be specified with a value between 5 and 3600 seconds. -If not specified, the default is 60 seconds. .It Fl D Debugging mode. .Nm does not disassociate from the controlling terminal. +.It Fl d Ar delay +Time in seconds to delay between automatic flushes of the file. +This may be specified with a value between 5 and 3600 seconds. +If not specified, the default is 60 seconds. .It Fl f Ar filename Log output filename. Default is @@ -119,13 +118,13 @@ Selects which packets will be dumped, using the regular language of .Bl -tag -width /var/run/pflogd.pid -compact .It Pa /var/run/pflogd.pid Process ID of the currently running -.Nm pflogd . +.Nm . .It Pa /var/log/pflog Default log file. .El .Sh EXAMPLES Log specific tcp packets to a different log file with a large snaplen -(useful with a log-all rule to dump complete sessions) +(useful with a log-all rule to dump complete sessions): .Bd -literal -offset indent # pflogd -s 1600 -f suspicious.log port 80 and host evilhost .Ed @@ -136,7 +135,8 @@ Display binary logs: .Ed .Pp Display the logs in real time (this does not interfere with the -operation of pflogd): +operation of +.Nm ) : .Bd -literal -offset indent # tcpdump -n -e -ttt -i pflog0 .Ed @@ -146,7 +146,7 @@ structure defined in .Aq Ar net/if_pflog.h . Tcpdump can restrict the output to packets logged on a specified interface, a rule number, a reason, -a direction, an ip family or an action. +a direction, an IP family or an action. .Pp .Bl -tag -width "reason match " -compact .It ip @@ -154,9 +154,9 @@ Address family equals IPv4. .It ip6 Address family equals IPv6. .It ifname kue0 -Interface name equals "kue0" +Interface name equals "kue0". .It on kue0 -Interface name equals "kue0" +Interface name equals "kue0". .It rulenum 10 Rule number equals 10. .It reason match |