Forum Discussion

Sarah's avatar
Sarah
Icon for Cirrus rankCirrus
Feb 09, 2026

Syslog Filter Configuration for Separating Audit and LTM logs.

Hello Community,   I am currently configuring a remote syslog and i have two syslog servers: One server should receive only Audit logs. The second server should receive all other logs (ltm), exc...
filter
syslog
Jeff_Granieri's avatar
Jeff_Granieri
Icon for Employee rankEmployee
Feb 19, 2026

HI Sarah​ ,

 

Yes your right local0 includes everything other than a few procs mentioned below.  have you tested this out in a lower environment

FacilityDescriptionDefault log file
local0All BIG-IP-specific messages other than bigd, sod, and proxyd messages./var/log/bigip
filter f_syslog_all_except_audit {
    not (facility(local0) and match("AUDIT"));
};

destination d_syslog_all {
    udp("1.2.3.4" port(514));
};

log {
    source(s_syslog_pipe);
    filter(f_syslog_all_except_audit);
    destination(d_syslog_all);
};