How to View & Watch the Firewall Log in Mac OS X
Users who have enabled the firewall in Mac OS X may find it useful to be view, read, and monitor the associated logs with the system firewall. As you’d expect, the app firewall logs show you what applications and processes have attempted to connect to the Mac, including accepted and refused connections.
There are several ways to view and watch the firewall in OS X, we’ll show you how to do so with a simple GUI app as well as the command line.
Note that if you have Stealth Mode enabled or are blocking every incoming connection attempt, your firewall log will likely look different if not be outright void for particular types of connections. Likewise, if you have the firewall disabled, you won’t see anything either, simply because there is no firewall to log connections. Additionally, if you are behind a hardware firewall like that found in a typical wi-fi router or network, your firewall log data is going to look different from a machine open to the wide world.
Reading Firewall Logs with Console app in Mac OS X
The simplest way for most users to read and view the firewall logs in OS X is through the general log viewing application called Console:
- Hit Command+Spacebar to bring up Spotlight and type in “Console”, then hit return on Console app to launch the application (it’s located in /Applications/Utilities/ if you wish to launch it manually)
- From the left side Log List menu, look under the “Files” section and click on the triangle next to /var/log to open that log list
- Select “appfirewall.log” from the sidebar log list to load the firewall log into the right console panel
A brief example of Console firewall log activity may look something like the following:
Nov 2 11:14:31 Retina-MacBook-Pro socketfilterfw[311]
Nov 5 14:58:33 Retina-MacBook-Pro socketfilterfw[311]
Nov 5 14:58:33 Retina-MacBook-Pro socketfilterfw[311]
Nov 5 15:57:52 Retina-MacBook-Pro socketfilterfw[311]
Nov 9 16:43:41 Retina-MacBook-Pro socketfilterfw[311]
Nov 12 11:32:57 Retina-MacBook-Pro socketfilterfw[311]
Nov 18 11:37:49 Retina-MacBook-Pro socketfilterfw[311]
Nov 18 21:28:43 Retina-MacBook-Pro socketfilterfw[320]
The firewall log viewed in Console will update as new connections are made, allowed, and rejected.
Watching Firewall Logs from the Command Line
From the command line you have a variety of methods to read and watch the firewall log in OS X. If you simply want to view the existing log as is and not when it updates with new connection data, you can use cat or more in Terminal app:
more /var/log/appfirewall.log
You can then browse through the log as usual with the arrow keys and return. Exit more when finished viewing the firewall log.
To follow a live updated version of the firewall log, use tail -f instead, like so:
tail -f /var/log/appfirewall.log
Using tail if similar to watching the firewall log from console application in the GUI, except of course you’re in the Terminal of OS X instead.
This might be beyond the scope of your normal tips, but could you guys do a stripped down guide to firewalling services using pf? I was using ipfw which is insanely simple, but it’s been deprecated and I can’t seem to get pf to work correctly. Would be hugely appreciated as I’ve had to disable some services (due to bruteforce login attempts) to which I used to allow only a few IPs via ipfw.
Yes, I’ve been waiting awhile now for something useful on pf…
The firewall logs on a router or server is much more interesting since it gets all sorts of stuff from the internet. My local Mac firewall log is basically connections to and from iTunes and local network shares, as it should be.
How do you monitor remote syslog from your router on an OSX machine?
Log in to your router IP and look at the logs. Every router uses different firmware and software, there isn’t a universal explanation.
Yes, see syslogd(8) under -udp_in. You need to edit the syslogd plist by hand and restart. Then tell your equipment the fixed IP address of your Mac, and you should get the log messages in Console and in /var/log. I did this once, but it proved too fiddly to continue doing, so I stopped.