Logging, Syslog and Log Anaylsys Forums
July 30, 2010, 09:37:48 pm
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
:
Home
WIKI
BLOG
Help
Search
Recent Topics
GoogleTagged
Login
Register
Logging, Syslog and Log Anaylsys Forums
>
Forums
>
syslog-ng
>
Problem with host filter after syslog 3.0.5 upgrade (SOLVED)
Pages: [
1
]
« previous
next »
Print
Author
Topic: Problem with host filter after syslog 3.0.5 upgrade (SOLVED) (Read 674 times)
doppiaemme2
Newbie
Offline
Posts: 2
Problem with host filter after syslog 3.0.5 upgrade (SOLVED)
«
on:
January 15, 2010, 09:03:20 am »
I to all,
I use a gentoo box as syslog central server. With syslog-ng version 2.1.x this config lines
source NET {udp(port(514)); tcp(port(5140) keep-alive(yes));};
destination FWSM-SONAPS { file("/var/log/FWSM-SONAPS"); };
destination FWSM-CYCLONE { file("/var/log/FWSM-CYCLONE" group(logviewer) perm(0640)); };
filter FWSM-SONAPS { host ("FWSM-SONAPS");};
filter FWSM-CYCLONE { host ("FWSM-CYCLONE");};
log { source(NET); destination(FWSM-SONAPS); filter(FWSM-SONAPS); };
log { source(NET); destination(FWSM-CYCLONE); filter(FWSM-CYCLONE); };
worked as I expected that is log messages coming from host FWSM-SONAPS went to /var/log/FWSM-SONAPS file
and log messages coming from host FWSM-CYCLONE went to /var/log/FWSM-CYCLONE.
The two hostnames are resolved locally in /etc/hosts
After upgrading to 3.0.x I got all the messages duplicated in both files so that messages coming from FWSM-SONAPS are written in /var/log/FWSM-SONAPS AND /var/log/FWSM-CYCLONE and vice-versa.
The same happens if I use netmask key as filter.
Coul please anuone help me?
Regards
MM
«
Last Edit: January 18, 2010, 11:14:37 am by doppiaemme2
»
Logged
Admin
Administrator
Newbie
Offline
Posts: 146
Re: Problem with host filter after syslog 3.0.5 upgrade
«
Reply #1 on:
January 17, 2010, 07:38:35 pm »
The order of tokens in the "log" statement is important in v3 now.
So, change the log lines to:
log { source(NET); filter(FWSM-SONAPS); destination(FWSM-SONAPS); };
log { source(NET); filter(FWSM-CYCLONE); destination(FWSM-CYCLONE); };
And it should work.
Logged
doppiaemme2
Newbie
Offline
Posts: 2
Re: Problem with host filter after syslog 3.0.5 upgrade (SOLVED)
«
Reply #2 on:
January 18, 2010, 11:09:47 am »
And indeed it worked!
Thank you very much for the tip!
Regards
MM
Logged
Pages: [
1
]
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
Forums
-----------------------------
=> Syslog & syslogd
=> syslog-ng
=> Log Data and Analysis
=> Windows Event Log
=> Web Server Logs
=> Security Event Management
=> General Discussion
===> Red Light District
Loading...