[twinspop]

Maybe this will prove handy for someone in the future. To enable logging with ipfw, you need to do a coupla things.

First, ignore the man page that tells you that ipfw logs to LOG_SECURITY. It doesn't. It logs to LOG_KERN. So adding this

kern.* /var/log/kernel.log

to the end of your /etc/syslogd.conf file will enable logging.

Now

sudo touch /var/log/kernel.log

and

sudo killall -HUP syslogd

Voila. Your 'log' commands in ipfw will work now. :-)

Finally...
Take a look in /etc/periodic/weekly/500.weekly to see where the other logs (ftp.log, system.log, etc) get rotated. Add kernel.log into the mix to prevent the og file from growing with limits.

[Sarc]

great tip, thx !
apple should make a more powerful GUI for IPFW, the one in Jaguar is not good enough