pflogd log

[Rakhesh Sasidharan]

> I noticed that pflog is not being written to.
>
> $ l /var/log/pflog
> -rw-r--r--  1 root  wheel  60 Jan 22 00:00 /var/log/pflog
>
> However, the process running pflogd runs as _pflogd. Does this mean I
> should chown the log file with user _pflogd?

I don't think so. Had a look at my machine, /var/log/pflog has permissions 
like on yours.

> _pflogd    248  0.0  0.2  1632  1056  ??  S     6:49AM   0:01.31
> pflogd: [suspended] -s 116 -f /var/log/pflog (pflogd)
>
> To complete the picture:
>
> $ ps aux |grep pf
> root        36  0.0  0.0     0     8  ??  DL    6:49AM   0:01.04 [softdepflush]
> root       246  0.0  0.2  1568  1004  ??  Is    6:49AM   0:00.01
> pflogd: [priv] (pflogd)
> _pflogd    248  0.0  0.2  1632  1056  ??  S     6:49AM   0:01.32
> pflogd: [suspended] -s 116 -f /var/log/pflog (pflogd)

I don't have pflogd: [suspended] though. Its pflogd: [running] for me. 
Have you tried restart /etc/rc.d/pflog?

Sorry, couldn't be of much help.

Regards,
Rakhesh

---
http://rakhesh.net/