Forum Discussion

mario365_345588's avatar
mario365_345588
Icon for Nimbostratus rankNimbostratus
Jan 09, 2018

Issue Using Multiple Filters with Syslog-ng

I can only get authpriv messages to send to my syslog server. When I try using multiple filters it breaks things & even the authpriv doesn't send. I tried adding one filter to my include statement to troubleshoot and when I add the user filter alone I can only get messages when the F5 is rebooted by root vias SSH. My goal is to have the F5 send only logins, logouts & config/command updates (both CLI & SH) to my syslog server. I read all the documents but cannot get both filters to work. The F5 accepts them but doesn't send the logs. Could this be a bug? Am I configuring things wrong? Here's my config...

 

 

application delivery
BIG-IP
security
TMSH
  • James_Taylor's avatar
    James_Taylor
    Icon for Nimbostratus rankNimbostratus
    Aug 21, 2019

    mario365 345588,

    You may have already tried this, but in may documents for filters in syslog-ng that appear on devcentral, you need to remove and re-add any syslog remote server before the filters are to take effect. Please see the impact of the procedure below.

     

    Removing the currently defined remote syslog servers

    You must remove the current defined remote syslog servers before you configure the include statement with the filter rule and destination server. To do so, perform the following procedure:

    Impact of procedure: Log messages will not be sent to the currently defined remote syslog servers until the remote syslog servers are re-added in the following procedure.

    1. Log in to tmsh by typing the following command:
    2. tmsh
    3. To list any currently defined remote syslog servers, if configured, type the following command:
    4. list /sys syslog remote-servers
    5. The following is an example of the command output on a BIG-IP system that is configured with a remote syslog server at IP address x.x.x.x:
    6. sys syslog {
    7. remote-servers {
    8. host x.x.x.x
    9. }
    10. }
    11. Take note of any currently defined remote syslog server information; you will need it in the following procedure.
    12. To remove the currently defined remote syslog servers, type the following command:
    13. modify /sys syslog remote-servers none
    14. Save the change by typing the following command:
    15. save /sys config partitions all