Forum Discussion
Aftab_1138
Nimbostratus
Mar 23, 2009syslog-ng filter not working
Using the guideline in this article:
http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&forumid=5&postid=8888
I created the following syslog-ng.conf section for logging from my iRule (named create_w3c_traffic_log) into a separate log file:
...
local0.info send w3c log entries to a separate file
filter f_local0_w3c_log {
facility(local0) and level(info) and match("create_w3c_traffic_log");
};
destination can be a hostname or IP address
destination d_logging {
file("/var/log/w3cLog" create_dirs(yes));
};
log {
source(local);
filter(f_local0_w3c_log);
destination(d_logging);
};
...
This logs properly to w3log file but the main log file "ltm" is also recording the same message. I have added the filter to the main log file to skip these messages, as:
...
local0.*/var/log/ltm
filter f_local0 {
facility(local0) and level(info..emerg) and not match("create_w3c_traffic_log");
};
filter f_no_audit {
not match("AUDIT");
};
destination d_ltm {
file("/var/log/ltm" create_dirs(yes));
};
log {
source(s_syslog_pipe);
filter(f_local0);
filter(f_no_audit);
destination(d_ltm);
};
...
What is wrong here?
I have BIG-IP 10.0.0 Build 5460.0 Hotfix HF1 software.
4 Replies
Sort By
- hoolio
Cirrostratus
The configuration looks correct as far as I can see. If syslog-ng isn't restarting due to a config error, I'd suggest opening a case with F5 Support on this. - Aftab_1138
Nimbostratus
I contacted support and they said that modifying syslog-ng.conf is not supported. If anyone has any resolution please let me know. Thanks. - hoolio
Cirrostratus
Sorry, I thought you were referencing this article: - Aftab_1138
Nimbostratus
Thanks. This article solved my problem. The support person did not tell me about the include process (I had looked at similar process but forgot about it). They were saying that any changes to syslog are not supported by customer support.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects