Packet Filter (PF) firewall logging
Packet filter doesn't log on any file. It does log on a network interface named pflog0
(a special device in Unix-lang), see
man pf.conf
You turn on this interface with:
/usr/bin/sudo ifconfig pflog0 create
You suppress it with:
/usr/bin/sudo ifconfig pflog0 destroy
You can follow what does packet filter logs on this interface with
tcpdump
or wireshark
.
Ex. :
/usr/bin/sudo tcpdump -i pflog0
If you want to go any further with PF and without writing your own configuration files, I highly recommand to test Murus.