Forum Discussion
CirrusSyslog Filter Configuration for Separating Audit and LTM logs.
Hello Community,
I am currently configuring a remote syslog and i have two syslog servers:
- One server should receive only Audit logs.
- The second server should receive all other logs (ltm), excluding audit logs.
I have drafted a syslog filters configuration to achieve this and would appreciate a second review to validate the approach and assist with any recommended adjustment.
Thank you!
filter f_syslog_audit{
match(AUDIT);
};
filter f_syslog_ltm {
not match(AUDIT) and
facility(local0);
};
destination d_syslog_server {
udp(\"5.6.7.8\" port(514));
};
destination d_syslog_ltm {
udp(\"1.2.3.4\" port(514));
};
log {
source(s_syslog_pipe);
filter(f_syslog_audit);
destination(d_syslog_server);
};
log {
source(s_syslog_pipe);
filter(f_syslog_ltm);
destination(d_syslog_ltm);
};
5 Replies
- Jeff_Granieri
Employee
Hi Sarah ,
This should work:
filter f_syslog_audit { match("AUDIT"); }; filter f_syslog_ltm { not match("AUDIT") and facility(local0); }; destination d_syslog_server { udp("5.6.7.8" port(514)); }; destination d_syslog_ltm { udp("1.2.3.4" port(514)); }; log { source(s_syslog_pipe); filter(f_syslog_audit); destination(d_syslog_server); }; log { source(s_syslog_pipe); filter(f_syslog_ltm); destination(d_syslog_ltm); };
SarahHello Jeff,
Thank you for your response.
If i want to forward all log sources except the audit logs, would the below filter work?
filter f_syslog_all { not match("AUDIT") }; destination d_syslog_all { udp("1.2.3.4" port(514)); }; log { source(s_syslog_pipe); filter(f_syslog_all); destination(d_syslog_all); };
- Jeff_Granieri
this may be more inline on what you want to do
filter f_syslog_all_except_audit { not facility(local0); }; destination d_syslog_all { udp("1.2.3.4" port(514)); }; log { source(s_syslog_pipe); filter(f_syslog_all_except_audit); destination(d_syslog_all); };- Sarah
Thank you Jeff!
Isn't the facility local0 statement include LTM log files?
My intention is to forward all logs file (ltm, gtm, messages, ... etc) to the syslog server, while excluding any AUDIT logs.
- Jeff_Granieri
HI Sarah ,
Yes your right local0 includes everything other than a few procs mentioned below. have you tested this out in a lower environment
Facility Description Default log file local0 All BIG-IP-specific messages other than bigd, sod, and proxyd messages. /var/log/bigip filter f_syslog_all_except_audit { not (facility(local0) and match("AUDIT")); }; destination d_syslog_all { udp("1.2.3.4" port(514)); }; log { source(s_syslog_pipe); filter(f_syslog_all_except_audit); destination(d_syslog_all); };
