Forum Discussion

Sarah's avatar
Sarah
Icon for Cirrus rankCirrus
Feb 09, 2026

Syslog Filter Configuration for Separating Audit and LTM logs.

Hello Community,   I am currently configuring a remote syslog and i have two syslog servers: One server should receive only Audit logs. The second server should receive all other logs (ltm), exc...
filter
syslog
Jeff_Granieri's avatar
Jeff_Granieri
Icon for Employee rankEmployee
Feb 11, 2026

Hi Sarah​ ,

 

This should work:  

filter f_syslog_audit { match("AUDIT"); };
filter f_syslog_ltm { not match("AUDIT") and facility(local0); };
destination d_syslog_server { udp("5.6.7.8" port(514)); };
destination d_syslog_ltm { udp("1.2.3.4" port(514)); };
log { source(s_syslog_pipe); filter(f_syslog_audit); destination(d_syslog_server); };
log { source(s_syslog_pipe); filter(f_syslog_ltm); destination(d_syslog_ltm); };
  • Sarah's avatar
    Sarah
    Icon for Cirrus rankCirrus
    Feb 17, 2026

    Hello Jeff,

     

    Thank you for your response.

    If i want to forward all log sources except the audit logs, would the below filter work?

     

    filter f_syslog_all { not match("AUDIT") };
destination d_syslog_all { udp("1.2.3.4" port(514)); };
log { source(s_syslog_pipe); filter(f_syslog_all); destination(d_syslog_all); };