For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Wallace1's avatar
Wallace1
Icon for Nimbostratus rankNimbostratus
Jun 01, 2020

Filtering messages for remtoe syslog servers

Looking at knowledge articles K1333 and K7342, I was able to get the filters to work in our environment with the following include statement:

 

  include "

#local0.info send logger entries to remote syslog server

  filter f_local0.info {

    facility(local0) and level(info) and match(logger);

   };

 

   destination d_logger_2 {

    udp(\"192.168.1.117\" port(11417));

   };

 

   log {

    source(local);

    filter(f_local0.info);

    destination(d_logger_2);

   };

# local logs /var/log/ltm

   filter f_local {

   level(info..emerg) and not match(\\logger);

   };

 

   destination d_ltm {

    file(/var/log/ltm create_dirs(yes));

    udp(\"192.168.100.100\" port(514));

   };

 

   log {

    source(local);

    filter(f_local);

    destination(d_ltm);

  };

   "

 

 

But looking at the different facilities list in K15934495 this will make all the log goto /var/log/ltm and not hit /var/log/gtm, asm, apm, how can I accomplish this goal?

 

Thanks in advanced for your help.

 

Wallace

No RepliesBe the first to reply