Logging (cont)

If "body" is specified, the first 128 octets of the packet's content will be passed to ipmon (you have to specify ipmon options as well to actually get this info logged)
If "first" is specified, then for "keep" options, just the packet leading to the state entry will be logged
If "or-block" is specified, then a log failure will result in blocking the packet
"level" overrides the default logging level (only makes sense for syslogging)

If "body" is specified, the first 128 octets of the packet's content will be passed to ipmon (you have to specify ipmon options as well to actually get this info logged)