Forum Discussion
syslog include filter that adds a text string to events
I would like to add a text string like "ASM_system_error" to every local3 event of level critical to emergency since syslog doesn't include the severity level in the log event itself (unless we have something configured wrong). Right now the include statement is something like this:
sys syslog include "filter f_waffilter { facility(local3) and (level(emerg) or level(alert) or level(crit));};destination waf_udp { udp(9.9.9.9 port(9999));}; log { source(local); filter(f_waffilter); destination(waf_udp);};"
- Kevin_Davies
Nacreous
Templates of syslog-ng do this but there is no guarantee that its works on an F5. YMMV
- cdjac0bsen
Nimbostratus
Thanks, Kevin. That seems like a lot of work. Was hoping for a simple addition to the include filter. Oh well. Does anyone know why the severity level isn't included in the log event sent remotely?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com