Forum Discussion
smp_86112
Cirrostratus
Sep 18, 2008Custom syslog-ng facility
I've got a log statement in an iRule which generates quite a bit of information to the local0 syslog-ng facility. Instead of logging to the local0 facility, I'd like to isolate these entries from local0, and instead put them into their own log file.
I was thinking I could do this by using a custom syslog-ng facility like this:
iRule:
when HTTP_REQUEST {
log local100. "some log entry"
}
Then in syslog-ng.conf, I'd have something like this:
filter custom_filter {
facility(local100);
};
destination custom_log {
file("/var/log/customlog");
};
log {
source(local);
filter(custom_filter);
destination(custom_log);
};
But the LTM log indicates local100 is an invalid facility. Is it possible to define your own syslog-ng facilities like this in some other manner?
3 Replies
- hoolio
Cirrostratus
I don't think syslog facilities out of the standard are allowed. Maybe someone can correct me here though.
Even with the existing facilities, you could use the same facility, but use separate destinations based on filters. You can check this post for an example (Click here).
Aaron - smp_86112
Cirrostratus
Yeah, I think that's what we're going to end up doing. I am hesitant twiddling with the defaults because they always seem to break during upgrades. Oh well, another thing to doc. - hoolio
Cirrostratus
Yep... you can include it in the UCS file, but it will most likely get overwritten in an upgrade if there are any changes to the installation's syslog-ng configuration file.
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
