cancel
Showing results for 
Search instead for 
Did you mean: 
Login & Join the DevCentral Connects Group to watch the Recorded LiveStream (May 12) on Basic iControl Security - show notes included.

syslog include filter that adds a text string to events

cdjac0bsen
Nimbostratus
Nimbostratus

I would like to add a text string like "ASM_system_error" to every local3 event of level critical to emergency since syslog doesn't include the severity level in the log event itself (unless we have something configured wrong). Right now the include statement is something like this:

 

sys syslog include "filter f_waffilter { facility(local3) and (level(emerg) or level(alert) or level(crit));};destination waf_udp { udp(9.9.9.9 port(9999));}; log { source(local); filter(f_waffilter); destination(waf_udp);};"

2 REPLIES 2

Templates of syslog-ng do this but there is no guarantee that its works on an F5. YMMV

 

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.17/administration-...

cdjac0bsen
Nimbostratus
Nimbostratus

Thanks, Kevin. That seems like a lot of work. Was hoping for a simple addition to the include filter. Oh well. Does anyone know why the severity level isn't included in the log event sent remotely?