tmsh Syslog match filter script

Do you want it to match a message that contains both "Virtual /Common/" AND "pool /Common/", or messages that contain either of those (but not necessarily both)?

To get the "either" match:

  filter f_custom {
    level (notice) and (match (\"Virtual /Common/\") or match (\"pool /Common/\"));
  };

To get the "and" match, you can either:

  filter f_custom {
    level (notice) and match (\"Virtual /Common/\") and match (\"pool /Common/\");
  };

or you can string together filters:

  filter f_notice_only {
    level (notice);
  };
  filter f_virtual_common {
    match (\"Virtual /Common/\");
  };
  filter f_pool_common {
    match (\"pool /Common/\")
  };

  log {
    source (s_syslog_pipe);  

    filter (f_notice_only); filter (f_virtual_common); filter (f_pool_common);
    destination (d_your_custom_destination);
  };

The

log

Thanks, seems to be working. Im using the "either" match" and im getting logs if the Pool Member or Vip is down.