emailserver = "192.0.2.225" pass log proto tcp to $emailserver port $email pass log proto tcp from $emailserver to port smtp
or log to separate pflog interface
pass log (to pflog1) proto tcp to $emailserver port $email pass log (to pflog1) proto tcp from $emailserver to port smtp