How to filter syslog messages

Hi Minquan,

I think the issue is with the the log statement. Also, there is no need to recreate objects which already exist if you're not re-defining them with modifications (like destination d_ltm).

To undo the past changes, you can edit the /config/bigip_sys.conf file and remove the configuration section, syslog {} and then run 'b load'. This will update the syslog-ng.conf file in /etc/syslog-ng (linked to /var/run/config/syslog-ng.conf).

Then try this for the syslog include file:

 
 syslog include " 
 destination remote_server { 
    tcp(\"192.168.20.83\" port (514)); 
 }; 
 filter f_local0_audit.info { 
    facility(local0) and level(notice) and match(\"AUDIT\"); 
 }; 
 log { 
    source(local); 
    filter(f_local0_audit.info); 
    destination(remote_server); 
 };" 
 

You should use the syslog include file method or the 'b syslog remote server x.x.x.x' method, but not both.

You can use 'b syslog list all' to see the entire syslog-ng configuration running in memory.

Aaron