1pass log (user) 2pass log (all) 3pass log (to pflog7) 4block log (all, user, to pflog1) 5block log (to pflog1, user) 6