Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Answers

Custom syslog-ng facility

I've got a log statement in an iRule which generates quite a bit of information to the local0 syslog-ng facility. Instead of logging to the local0 facility, I'd like to isolate these entries from local0, and instead put them into their own log file.

I was thinking I could do this by using a custom syslog-ng facility like this:

iRule:
   
when HTTP_REQUEST {
log local100. "some log entry"
}


Then in syslog-ng.conf, I'd have something like this:
   
filter custom_filter {
facility(local100);
};

destination custom_log {
file("/var/log/customlog");
};

log {
source(local);
filter(custom_filter);
destination(custom_log);
};


But the LTM log indicates local100 is an invalid facility. Is it possible to define your own syslog-ng facilities like this in some other manner?
0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
I don't think syslog facilities out of the standard are allowed. Maybe someone can correct me here though.

Even with the existing facilities, you could use the same facility, but use separate destinations based on filters. You can check this post for an example (Click here).

Aaron
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Yeah, I think that's what we're going to end up doing. I am hesitant twiddling with the defaults because they always seem to break during upgrades. Oh well, another thing to doc.
0
placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER
Yep... you can include it in the UCS file, but it will most likely get overwritten in an upgrade if there are any changes to the installation's syslog-ng configuration file.

Aaron
0