Syslog include match granularity?

I wasn't sure whether the problem was with syntax or function, so I removed some potential syntax problems (removed the backslash which was escaping the closing double quote, removed the single quotes). I also added both the f_pool_member and f_jc_not_6 filters to the log definition. These would be logically AND'd together. If you only want to send the Pool Member logs to the remote syslog servers, you could remove the f_jc_not_6 filter from the log definition.

 

 

I'd guess the reason you're seeing other logs being sent to the syslog server is that the "Pool member" filter wasn't actually applied to the log definition.

 

 

Making these changes shouldn't have any impact on load balancing, but it's always ideal to test on a non-live unit. You could try testing the changes on the standby or a dev unit.

 

 

Aaron