Hatchet is a log parsing/presentation program written for OpenBSD's PF logs. Hatchet should be useful to the typical PF administrator who wishes to review their PF logs in a chronological order via a graphical (web) interface. Hatchet archives the logs so that you can search past events. It also allows you to sort by column, so that you may isolate traffic by source or destination address, service, rule number, etc. Additionally, it provides external links to perform DNS queries on source addresses and service quries from SANS.

Hatchet uses a series of Perl regexes to match entries from PF logs. Events are stored in a SQLite database file, allowing for highly dynamic queries and statistics. If it finds one it doesn't have a match for, it will kick off an email to the system administrator with the details. Although Hatchet uses SQLite, it does not require installation of the full SQLite 'suite', only the DBD::SQLite module, which incorporates the necessary libraries.

Hopefully you find this a useful, clean log viewing utility. I plan to incorporate new features eventually, particularly more advanced reporting, but time will tell. I happily accept feature requests, but I don't intend to incorporate features that would otherwise be best handled the 'OpenBSD way'. In other words, I won't add a PF ruleset editor, don't ask.

Thanks for trying out Hatchet. Please email me with your feedback, compliments, etc.