Mac Tips Daily! #151 - Firewall Logging

Submitted by jcost on Thu, 07/13/2006 - 20:18.

Are you a bit paranoid or security conscious? Perhaps you want to be able to track down when someone is trying to break into your Mac. OS X has a decent firewall, but tracking down what it's blocking can be a bit of a chore. Logging isn't on by default, so you have to do this manually.
Here is how to do it:

Open 'System Preferences'
system preferences
next, choose 'Sharing'
sharing

now, click on the 'Firewall' tab (make sure the firewall is 'ON' , and then click on 'Advanced'
firewall

Now, add a check mark next to 'Enable Firewall Logging'. Now, your firewall will add to the log when it blocks.
To view the log, simply click on 'Open Log'.

firewall

To view the log manually, from the Finder, choose GO->Utilities
Open 'CONSOLE', then click on 'LOGS'
Then in the lefthand pane, drill down until you can expand the' /var/log' area
After it is expanded, click on 'ipfw.log'
console

The file may be empty, especially if you just recently enabled logging.