Forum Discussion

bortega_340015's avatar
bortega_340015
Icon for Nimbostratus rankNimbostratus
Apr 16, 2019

Send /var/log/ltm on syslog destination without AUDIT logs

Hello everyone, I'm trying to filter just /var/log/ltm logs in F5 version 13.1.1.4, but with my configuration I can't filter the AUDIT logs, is still sending it to my syslog destination. I config...
application delivery
LTM
TMSH
  • AMiles_377865's avatar
    AMiles_377865
    Apr 16, 2019

    Hello Berenice,

    You're on the right track; your syntax is just a little off. Match now requires the use of "value()"

    So I think something like 

    filter no_audit { not match ( value=("AUDIT") );    };

    Reference: Syslog Guide 3.0

    Best of luck,

    Austin

AMiles_377865's avatar
AMiles_377865
Icon for Cirrocumulus rankCirrocumulus

Hello Berenice,

You're on the right track; your syntax is just a little off. Match now requires the use of "value()"

So I think something like 

filter no_audit { not match ( value=("AUDIT") );    };

Reference: Syslog Guide 3.0

Best of luck,

Austin

bortega_340015's avatar
bortega_340015
Icon for Nimbostratus rankNimbostratus
Apr 17, 2019

Hello Austin,

 

Thanks for your help. I modify the filter as you told me, but it shows a syntax error. However, your reference helps a lot. I find how to configure the filter like:

 

filter no_audit { not match (AUDIT value(MESSAGE) ); };

 

And it worked. Thanks.