Other log tools you may want to look into

The logs themselves and the various tcpdump options provide you with valuable tools to gain insight into what happens in your network. Not surprisingly, other tools have been developed to operate on PF log data, collect statistics and do various forms of graphing.

Of special note is Damien Miller's pfflowd, which collects PF log data, converts to Cisco NetFlow™ for further processing. Damien also develops and maintains see flowd for NetFlow™ collecting purposes. This Cisco originated data format is supported by a number of different products, and the ability to generate data in this format may be important in certain environments.

In OpenBSD 4.5, the pflow virtual network interface was added. Using the pflow state option (or a global set state-defaults pflow you can export NetFlow™ data from the PF state table via the pflowinterfaces. man pflow has more information, and this topic is covered in more detail in the second edition of The Book of PF. Some tips and descriptions of practical applications can be found in my blog article Yes, You Too Can Be An Evil Network Overlord - On The Cheap With OpenBSD, pflow And nfsen.

One other log data application which is well worth noting is Daniel Hartmeier's pfstat, which collects statistics from PF logs and generates graphs from the data. It's a fairly flexible package which takes a lot of the heavy lifting out of presenting log data.