Forum Discussion
Sarah
Cirrus
CirrusSyslog Filter Configuration for Separating Audit and LTM logs.
Hello Community, I am currently configuring a remote syslog and i have two syslog servers: One server should receive only Audit logs. The second server should receive all other logs (ltm), exc...
Jeff_Granieri
Employee
Employeethis may be more inline on what you want to do
filter f_syslog_all_except_audit {
not facility(local0);
};
destination d_syslog_all {
udp("1.2.3.4" port(514));
};
log {
source(s_syslog_pipe);
filter(f_syslog_all_except_audit);
destination(d_syslog_all);
};
SarahThank you Jeff!
Isn't the facility local0 statement include LTM log files?
My intention is to forward all logs file (ltm, gtm, messages, ... etc) to the syslog server, while excluding any AUDIT logs.
