Forum Discussion

JCMATTOS_41723's avatar
JCMATTOS_41723
Icon for Nimbostratus rankNimbostratus
Jan 07, 2010

Syslog include match granularity?

We currently use 2 syslog remote servers and would like to limit the amount of log traffic to our servers. More specifically, we only want to see "Pool member" monitor up/down status messages. I tried...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jan 07, 2010
Hi JC,

What are the symptoms of the failure? Does syslog-ng start? If so, what happens/what doesn't happen that you expect to?

Can you try clearing your existing syslog include config using 'b syslog include none' and then create a file named /var/tmp/syslog.test.inc which contains the following: 

 
 syslog include " 
  
 destination d_loghost { 
  udp(\"172.22.X.X\" port(514)); 
  udp(\"172.24.X.X\" port(514)); 
 }; 
 filter f_pool_member { 
  match(\"Pool member\"); 
 }; 
 filter f_jc_not_6 { 
  not facility(local6); 
 }; 
 log { 
  source(local); 
  filter(f_pool_member); 
  filter(f_jc_not_6); 
  destination(d_loghost); 
 }; 
 "

The run bpsh < /var/tmp/syslog.test.inc

If that works, save the change from memory to file using 'b save'.

Thanks,

Aaron