PFSTAT(8)

NAME
pfstat - collect packet filter statistics and generate graphs

SYNOPSIS
pfstat [-q] [-c config] [-d data]

DESCRIPTION
The pfstat utility can query statistics from the packet filter device pf(4) and produce graphs from the collected data.

The options are as follows:

-q  Query the current set of statistics from the packet filter and print them on one line to stdout. This is usually done from a cronjob(5) like this:

        * * * * * /usr/local/bin/pfstat -q >>/var/log/pfstat

    Note that the file will gradually grow and should be truncated occasionally:

        1 1 * * 1 tail -n 50000 /var/log/pfstat >/tmp/pfstat &&
                                mv /tmp/pfstat /var/log/pfstat

-c config
    Configuration file for graph generation. Syntax:

        image   = "image" filename "{"
                      time type size [ left ] [ right ] "}" .
        time    = "from" number [ unit ] [ "to" number [ unit ] ] .
        unit    = "minutes" | "hours" | "days" | "weeks" | "months" | "years" .
        type	= "type" ( "jpeg" | "png" ) .
        size    = "width" number "height" number .
        left    = "left" graphs .
        right   = "right" graphs .
        graphs  = graph [ "," graphs ] .
        graph   = "graph" name "label" string
                      "color" red green blue [ "filled" ] .

    Several images can be defined in the same config file. An image can include two independant y-axes, both of which auto-scale independantly to the maximum value in the selected range. Each axis can display an arbitrary number of graphs.

    The possible graph names are:

    bytes_v4_in
    bytes_v4_out
    bytes_v6_in
    bytes_v6_out
    packets_v4_in_pass
    packets_v4_in_drop
    packets_v4_out_pass
    packets_v4_out_drop
    packets_v6_in_pass
    packets_v6_in_drop
    packets_v6_out_pass
    packets_v6_out_drop
    states_entries
    states_searches
    states_inserts
    states_removals
    counters_match
    counters_badoffset
    counters_fragment
    counters_short
    counters_normalize
    counters_memory

-d data
    Data file, generated with the -q option. To generate new graphs every 5 minutes, the following cronjob could be used:

        */5 * * * * /usr/local/bin/pfstat -c /etc/pfstat.conf
                        -d /var/log/pfstat >/dev/null

EXAMPLES

    # pfstat.conf example
    image "/var/www/htdocs/one.jpg" {
    	from 12 months to 6 months
    	width 320 height 240
    	left
    		graph bytes_v4_in label "incoming" color 0 0 255 filled
    }
    image "/var/www/htdocs/two.jpg" {
    	from 3 days to now
    	width 800 height 300
    	left
    		graph bytes_v4_in label "incoming" color 0 255 0 filled,
    		graph bytes_v4_out label "outgoing" color 0 0 255
    	right
    		graph states_entries label "states" color 255 0 0
    }
    image "/var/www/htdocs/three.png" {
    	from 4 hours to now
    	type png
    	width 1000 height 700
    	left
    		graph packets_v4_in_pass label "pass in" color 0 255 0 filled,
    		graph packets_v4_out_pass label "pass out" color 0 0 255
    	right
    		graph packets_v4_in_drop label "block in" color 255 0 0,
    		graph packets_v4_out_drop label "block out" color 200 200 0
    }

SEE ALSO
pf(4), crontab(5), pfctl(8)