syslog filter to 2 remote server

sorry I`m not sure modified config work or not.

it there anything wrong?

Hi,

Run

edit sys syslog

modify syslog {
    include "
    filter f_ltm {
        facility(local0)
        and level(debug..emerg)
        and not match(\"Clock has unexpectedly adjusted by\")
        and not match(\"Tmstat::updateSensorTbls: HAL SenSvc error: BourneSeepromDev\")
        and not match(\"http_process_state_prepend\") and not match(\"Tcpdump\");
    };
    destination d_logsvr {
        udp(\"192.168.0.29\" port(514));
    };
    destination d_logsvr2 {
        udp(\"192.168.0.30\" port(514));
    };
    log {
        source(local);
        filter(f_ltm);
        destination(d_logsvr);
    };
    log {
        source(local);
        filter(f_ltm);
        destination(d_logsvr2);
    };"
}

I've not tested, but it should work.

Hi everyone,

I'm trying to understanding the configuration of syslog include. I found this article : https://support.f5.com/csp/article/K13333.

Here we go, for the bigip would I have the same behavior with or without the escapes '\"' surrounding the server IP? Ex.:

destination d_remote_loghost {

tcp(\"10.11.16.253\" port(1468));

udp(\"10.11.16.252\" port(514)); };

And this :

destination d_remote_loghost {

tcp('10.11.16.253' port(1468));

udp('10.11.16.252' port(514)); };

Could you clarify this please? Thanks a lot. Best regards.

Hi everyone,

I'm trying to understanding the configuration of syslog include. I found this article : https://support.f5.com/csp/article/K13333.

Here we go, for the bigip would I have the same behavior with or without the escapes '\"' surrounding the server IP? Ex.:

destination d_remote_loghost {

tcp(\"10.11.16.253\" port(1468));

udp(\"10.11.16.252\" port(514)); };

And this :

destination d_remote_loghost {

tcp('10.11.16.253' port(1468));

udp('10.11.16.252' port(514)); };

Could you clarify this please? Thanks a lot. Best regards.