Forum Discussion
smp_86112
Cirrostratus
Sep 18, 2008Custom syslog-ng facility
I've got a log statement in an iRule which generates quite a bit of information to the local0 syslog-ng facility. Instead of logging to the local0 facility, I'd like to isolate these entries from local0, and instead put them into their own log file.
I was thinking I could do this by using a custom syslog-ng facility like this:
iRule:
when HTTP_REQUEST {
log local100. "some log entry"
}
Then in syslog-ng.conf, I'd have something like this:
filter custom_filter {
facility(local100);
};
destination custom_log {
file("/var/log/customlog");
};
log {
source(local);
filter(custom_filter);
destination(custom_log);
};
But the LTM log indicates local100 is an invalid facility. Is it possible to define your own syslog-ng facilities like this in some other manner?
- hoolio
Cirrostratus
I don't think syslog facilities out of the standard are allowed. Maybe someone can correct me here though. - smp_86112
Cirrostratus
Yeah, I think that's what we're going to end up doing. I am hesitant twiddling with the defaults because they always seem to break during upgrades. Oh well, another thing to doc. - hoolio
Cirrostratus
Yep... you can include it in the UCS file, but it will most likely get overwritten in an upgrade if there are any changes to the installation's syslog-ng configuration file.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects