Change PF logfile location

[xy16644]

I am busy tidying up my logfiles in /var/log and I would like to keep one years worth of logs for PF. I can't seem to get this right so can somone check what I have done and let me know what I am missing please. I would like to change the logfile location to /var/log/firewall

First I created a new folder in /var/log called firewall.

I then added the following to /etc/rc.conf

pflog_logfile="/var/log/firewall" (I tried /var/log/firewall/pflog too)

but after restarting PF and Syslog as follows:

/etc/rc.d/syslogd restart
/etc/rc.d/pf restart

I have no pflog file in /var/log/firewall. What am I doing wrong?:e

 

[SirDice]

You never started pflogd(8).

pflogd_enable="YES"

# service pflogd start

 

[xy16644]

Thanks but it was running. It (pflogd) did need a restart to create the log in the new location!