Packet Filter (PF) firewall logging

Packet filter doesn't log on any file. It does log on a network interface named pflog0 (a special device in Unix-lang), see

man pf.conf

You turn on this interface with:

/usr/bin/sudo ifconfig pflog0 create

You suppress it with:

/usr/bin/sudo ifconfig pflog0 destroy

You can follow what does packet filter logs on this interface with tcpdump or wireshark.

Ex. :

/usr/bin/sudo tcpdump -i pflog0

If you want to go any further with PF and without writing your own configuration files, I highly recommand to test Murus.