mxu_65255
Sep 04, 2009Nimbostratus
How to filter syslog messages
Hi,
I tried to filter out some syslog messages using syslog include, but it seems filter does not work. My syslog server gets all syslog messages.
This is my reference:
http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=155.
My device:
Product: BIG-IP
Version: 9.4.7
Build: 320.1
BaseBuild: 320.1
Edition: Final
My syslog.inc
syslog include "
destination remote_server {
tcp(\"192.168.20.83\" port (514));
};
filter f_local0.info {
facility(local0) and level(notice) and match(\"AUDIT\");
};
filter f_no_local6 {
not facility(local6);
};
destination d_ltm {
file(\"/var/log/ltm\" create_dirs(yes));
};
log {
source(local);
filter(f_local0.info);
filter(f_no_local6);
destination(d_ltm);
destination(remote_server);
};"
Another thing I did was setting remote server:
bigpipe syslog remote server 192.168.20.83, otherwise, I could not get syslog.
Is there anything wrong with the configure? How to I filter syslog for this version of f5?
Thanks,
Minquan