swjo_264656
Dec 02, 2016Cirrostratus
syslog filter to 2 remote server
Hi
I will be very grateful to you if anyone advice configure.
I`m going to send syslog to two syslog server.
modify sys syslog { include "filter f_ltm {facility(local0) and level(debug..emerg);};destination d_logsvr {udp(\"192.168.0.29\" port(514));}; destination d_logsvr2 {udp(\"192.168.0.30\" port(514));}; log {source(local);filter(f_ltm);destination(d_logsvr);}; log {source(local);filter(f_ltm);destination(d_logsvr2);};" }
I tested this config and it works well.
I have to insert this filter
filter f_no_log {
not match(\"Clock has unexpectedly adjusted by\")
and not match(\"Tmstat::updateSensorTbls: HAL SenSvc error: BourneSeepromDev\") and not match(\"http_process_state_prepend\") and not match(\"Tcpdump\");
}; so I configed like this
typing tmsh and input this
modify sys syslog { include "filter f_ltm {facility(local0) and level(debug..emerg) and not match(\"Clock has unexpectedly adjusted by\") and and not match(\"Tmstat::updateSensorTbls: HAL SenSvc error: BourneSeepromDev\") and and not match(\"http_process_state_prepend\") and and not match(\"Tcpdump\");};destination d_logsvr {udp(\"192.168.0.29\" port(514));}; destination d_logsvr2 {udp(\"192.168.0.30\" port(514));}; log {source(local);filter(f_ltm);destination(d_logsvr);}; log {source(local);filter(f_ltm);destination(d_logsvr2);};" }
but it doesn`t work well.
How can I modify this config?
thank you.