Disabling Firewall logging

I've found a way to disable logging while keeping stealth mode enabled. Unfortunately, it involves a little manual plist editing and converting from/to binary xml format. Here's what worked for me in a terminal session:

cd /Library/Preferences
sudo plutil -convert xml1 com.apple.alf.plist

Careful, that's a lower case 'L' and a number '1' above.

sudo nano com.apple.alf.plist

search (ctrl-W) for the key loggingenabled
change the integer value to 1
save the file (ctrl-O)
quit nano (ctrl-X)

sudo /usr/bin/plutil -convert binary1 com.apple.alf.plist

That should do it but to be safe you might want to log out and back in (or restart for overkill).

I don't know about others, but the volume of my denied connection attempts really taxed the appfirewall.log. Often there were several entries logged every second.

oops, sorry

change the integer value to 0

Another slightly related post prompted me to try an alternate approach to disabling firewall logging. I didn't try it at first thinking the permissions on the com.apple.alf.plist file would prevent it.

If you have access to the optional Developer install, the property list editor in /Developer/Utilities will easily allow you to change the loggingenabled key value on /Library/Preferences/com.apple.alf.plist.

I'm assuming one needs at least admin privileges.