OpenBSD PF Logging and Monitoring - Beginner Guide

OpenBSD PF Logging and Monitoring - Beginner Guide

OpenBSD's PF firewall keeps logs of what it's blocking and allowing. Here's how to view and use those logs.

Why Logging Matters

Security monitoring: Logs show you what kind of attacks your firewall is blocking.
Troubleshooting: If something isn't working as expected, logs show why.
Audit trail: Logs keep a record of network activity for security analysis.

By default, OpenBSD enables logging in PF, so you don't need to configure much to get started.

Step 1: View Basic PF Logs

The easiest way to see PF activity:

pfctl -s log - show PF log summaries

You'll see output like:
blocking in on egress0 from 203.0.113.5 to 192.168.1.1 port 46826\n ... (snip many lines)\n blocking in on egress0 from 185.220.101.1 to 192.168.1.1 port 58972\n

This shows: Attempts to connect to your computer from specific IP addresses and ports.

pfctl -s rules - show current PF rules (for context of what's being blocked/allowed)

Step 2: View Detailed Logs

For more detailed information:

pfctl -s info - show PF information (states, statistics, etc.)

pftop - real-time graphical monitor of PF activity (requires X Window System or terminal support)

To exit pftop: Press q

Step 2: Enable and Configure Logging

PF logging is enabled by default, but you can control what's logged:

In /etc/pf.conf, add logging to your rules:

Example: Log SSH connections:

pass in on egress proto tcp from any to any port 22 log

pass in on egress proto tcp from any to any port { 22 80 443 } log

Step 3: Log Rotation

Log files can grow very large. OpenBSD uses newsyslog to manage them.

The configuration file: /etc/newsyslog.conf

Default settings: Logs are rotated daily, kept for 7 days, compressed.

To manually rotate logs:
newsyslog -f /etc/newsyslog.conf

To view rotated logs: They're typically in /var/log with dates in filenames

Common log files:
/var/log/messages - general system messages
/var/log/security - security-related events
/var/log/pflog - PF firewall logs (the special one!)

Step 4: Analyzing Logs

View the PF log file directly:
cat /var/log/pflog - shows PF logs (use less or more for large files)

Search for specific things:
grep "blocking" /var/log/pflog - show only blocked connections
grep "192.168.1.100" /var/log/pflog - show connections from your IP
grep "port 22" /var/log/pflog - show SSH connection attempts

Count blocking attempts:
grep -c "blocking" /var/log/pflog - count how many times things were blocked

Top blocking IPs:
grep "blocking in" /var/log/pflog | grep -oP "from \K[0-9.]+" | sort | uniq -c | sort -rn | head

(This shows which IP addresses are trying to connect to your computer most frequently)

Advanced PF topics? Proceed to Lesson 23: PF Advanced Rules.

Next: OpenBSD SSH Hardening - Beginner Guide

Article author: Arthur Isaev