Forum Discussion
Tim_92618
Nimbostratus
Nimbostratussyslog filtering
we are trying to modify our syslog to get just warning and emergency level notifications, but all of the filters we have tried are not working.
nitass_89166
Noctilucent
Noctilucentwe are trying to modify our syslog to get just warning and emergency level notifications, but all of the filters we have tried are not working.have you tried syslog include in this sol?
sol11723: Filtering log messages sent to remote syslog servers (9.4.x - 10.x)
http://support.f5.com/kb/en-us/solutions/public/11000/700/sol11723.html
We have tried the syslog include statements from many articles and yet the informational, debug, and notice events are still forwarding. It seems this should be a basic functionality of the LTM so any assistance would be appreciated.your syslog include command is correct but the wrong is remotesyslog1. since you use syslog include, you do not need to have remotesyslog1. remove it and it will work. :-)
Alternatively you could do it all form the command line and not go into vi using: The next is all on one line
tmsh modify /sys syslog include "filter f_remote_loghost {level(info..emerg);};filter f_ssl_acc_req {not (facility(local6) and level(info) and match('[ssl_acc\\]')) or not (facility(local6) and level(info) and match('[ssl_req\\]'));};destination d_remote_loghost {udp(\"192.168.2.102\" port(514));};log {source(s_syslog_pipe);filter(f_remote_loghost);filter(f_ssl_acc_req);destination(d_remote_loghost);};"
And then
tmsh save /sys config
