Firewall logs

fivenotrump

macrumors 6502
Original poster
Apr 15, 2009
357
122
Central England
There is no such tab or menu item in Console.app. There is an empty /var/log/appfirewall.log – this is where firewall events were logged pre-Sierra.
 

fivenotrump

macrumors 6502
Original poster
Apr 15, 2009
357
122
Central England
check logging is on (should be):
/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmode
check logging option:
/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingopt
mine said 'throttled', so:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingopt detail

check logging config for subsystem:
sudo log config --status --subsystem com.apple.alf
likely says "Mode for 'com.apple.alf' INFO PERSIST_DEFAULT" so:
sudo log config --mode "persist:info" --subsystem com.apple.alf

now use log(1) like
log show --predicate 'subsystem == "com.apple.alf"' --info --last 1h

I do get some log entries when expected but they all have the same useful message "<private>"
 

fivenotrump

macrumors 6502
Original poster
Apr 15, 2009
357
122
Central England
I wasn't aware of "open radar" before, thanks for the information!

Care to share the link for your radar ?
Sorry for the ambiguity: I have a radar open with Apple, not entered in to OpenRadar. It would be helpful if others with similar problems were to open radars with Apple as this lends weight when they are considering priorities.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.