Logging, Syslog and Log Anaylsys Forums
July 30, 2010, 09:37:48 pm *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News:
   Home   WIKI BLOG Help Search Recent Topics GoogleTagged Login Register  
Pages: [1]
  Print  
Author Topic: Problem with host filter after syslog 3.0.5 upgrade (SOLVED)  (Read 674 times)
doppiaemme2
Newbie
*
Offline Offline

Posts: 2


View Profile
« on: January 15, 2010, 09:03:20 am »

I to all,
I use a gentoo box as syslog central server. With syslog-ng version 2.1.x this config lines

source NET {udp(port(514)); tcp(port(5140) keep-alive(yes));};

destination FWSM-SONAPS { file("/var/log/FWSM-SONAPS"); };
destination FWSM-CYCLONE { file("/var/log/FWSM-CYCLONE" group(logviewer) perm(0640)); };

filter FWSM-SONAPS { host ("FWSM-SONAPS");};
filter FWSM-CYCLONE { host ("FWSM-CYCLONE");};

log { source(NET); destination(FWSM-SONAPS); filter(FWSM-SONAPS); };
log { source(NET); destination(FWSM-CYCLONE); filter(FWSM-CYCLONE); };


worked as I expected that is log messages coming from host FWSM-SONAPS went to /var/log/FWSM-SONAPS file
and log messages coming from host FWSM-CYCLONE went to /var/log/FWSM-CYCLONE.

The two hostnames are resolved locally in /etc/hosts

After upgrading to 3.0.x I got all the messages duplicated in both files so that messages coming from FWSM-SONAPS are written in /var/log/FWSM-SONAPS AND /var/log/FWSM-CYCLONE and vice-versa.
The same happens if I use netmask key as filter.
Coul please anuone help me?
Regards
MM
« Last Edit: January 18, 2010, 11:14:37 am by doppiaemme2 » Logged
Admin
Administrator
Newbie
*****
Offline Offline

Posts: 146


View Profile WWW
« Reply #1 on: January 17, 2010, 07:38:35 pm »

The order of tokens in the "log" statement is important in v3 now.

So, change the log lines to:
log { source(NET); filter(FWSM-SONAPS); destination(FWSM-SONAPS); };
log { source(NET); filter(FWSM-CYCLONE); destination(FWSM-CYCLONE); };

And it should work.
Logged
doppiaemme2
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #2 on: January 18, 2010, 11:09:47 am »

And indeed it worked! Shocked

Thank you very much for the tip!
Regards
MM Grin
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC | Sitemap Valid XHTML 1.0! Valid CSS!