Ryfujk

Do natural melee weapons (from racial traits) trigger Improved Divine Smite?

What does it mean when I add a new variable to my linear model and the R^2 stays the same?

What can I do if someone tampers with my SSH public key?

A bug in Excel? Conditional formatting for marking duplicates also highlights unique value

Rationale to prefer local variables over instance variables?

Linear Combination of Atomic Orbitals

Named nets not connected in Eagle board design

Can inspiration allow the Rogue to make a Sneak Attack?

Is divide-by-zero a security vulnerability?

Where is the fallacy here?

When to use the term transposed instead of modulation?

Ultrafilters as a double dual

PTIJ: Aliyot for the deceased

Where do you go through passport control when transiting through another Schengen airport on your way out of the Schengen area?

Integrating function with /; in its definition

Are small insurances worth it

What is better: yes / no radio, or simple checkbox?

Affine transformation of circular arc in 3D

What is "desert glass" and what does it do to the PCs?

Did Amazon pay $0 in taxes last year?

I've given my players a lot of magic items. Is it reasonable for me to give them harder encounters?

3.5% Interest Student Loan or use all of my savings on Tuition?

Under what conditions would I NOT add my Proficiency Bonus to a Spell Attack Roll (or Saving Throw DC)?

What is the purpose of a disclaimer like "this is not legal advice"?

Syslog-ng loghost - filter not-match

Remote logging for multiple Apache virtual hosts using syslog-ngFilter out a facility in syslog-ngIIS Advanced Logging Forward to SyslogRemove Iptables log from kern.log syslog messagesSyslog-ng not logging on debiansyslog-ng 3.5 flush_lines not working with smtpHow do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?Avoid logging in /var/log/syslog only using /etc/syslog-ng/conf.d/How can I compare ${HOST} and ${HOST_FROM} (or why ${HOST} != ${HOST})?Wifi appliance not sending syslog

0

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong.
It seems like filters are not working for received logs from remote hosts.

This is a part of my configuration related to loghost:

Client (syslog-ng 3.3.5)
(it's working good because logs are reaching the loghost - i ran it in debug mode so i was able to confirm that)

destination d_net { syslog("10.20.8.2" transport ("tcp") port(514) ); };

filter f_auth { facility(auth, authpriv) and not filter(f_debug); };

log { source(s_src); filter(f_auth); destination(d_net); };

and server (syslog-ng 3.2.5 - my server syslog-ng.conf part:

source s_network { tcp(); udp(); };

destination d_loghost_auth { file("/opt/logs/sys/$YEAR-$MONTH-$DAY/auth.log" create_dirs(yes) ); };

filter f_loghost_auth { facility(auth) or facility(authpriv) };

log { source(s_network); filter(f_loghost_auth); destination(d_loghost_auth); };

---

so when i run server in debug & verbose mode and test it with logger (from client):

logger -n 10.20.8.2 -p auth.info "auth.info test syslog"

i'm getting this:

Incoming log entry; line='95 <38>1 2014-12-17T13:03:16+01:00 ibanez logger - - [meta sequenceId="65"] auth.info test syslog'

Filter rule evaluation begins; filter_rule='f_loghost_auth'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='OR'

Filter rule evaluation result; filter_result='not-match', filter_rule='f_loghost_auth'

I don't think that version mismatch is the reason.
I will appreciate any kind of help!

logging syslog syslog-ng

share|improve this question

asked Dec 17 '14 at 12:14

mysteqmysteq

11

bumped to the homepage by Community♦ 5 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

0

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong.
It seems like filters are not working for received logs from remote hosts.

This is a part of my configuration related to loghost:

Client (syslog-ng 3.3.5)
(it's working good because logs are reaching the loghost - i ran it in debug mode so i was able to confirm that)

destination d_net { syslog("10.20.8.2" transport ("tcp") port(514) ); };

filter f_auth { facility(auth, authpriv) and not filter(f_debug); };

log { source(s_src); filter(f_auth); destination(d_net); };

and server (syslog-ng 3.2.5 - my server syslog-ng.conf part:

source s_network { tcp(); udp(); };

destination d_loghost_auth { file("/opt/logs/sys/$YEAR-$MONTH-$DAY/auth.log" create_dirs(yes) ); };

filter f_loghost_auth { facility(auth) or facility(authpriv) };

log { source(s_network); filter(f_loghost_auth); destination(d_loghost_auth); };

---

so when i run server in debug & verbose mode and test it with logger (from client):

logger -n 10.20.8.2 -p auth.info "auth.info test syslog"

i'm getting this:

Incoming log entry; line='95 <38>1 2014-12-17T13:03:16+01:00 ibanez logger - - [meta sequenceId="65"] auth.info test syslog'

Filter rule evaluation begins; filter_rule='f_loghost_auth'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='OR'

Filter rule evaluation result; filter_result='not-match', filter_rule='f_loghost_auth'

I don't think that version mismatch is the reason.
I will appreciate any kind of help!

logging syslog syslog-ng

share|improve this question

asked Dec 17 '14 at 12:14

mysteqmysteq

11

bumped to the homepage by Community♦ 5 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

add a comment | 

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong.
It seems like filters are not working for received logs from remote hosts.

This is a part of my configuration related to loghost:

Client (syslog-ng 3.3.5)
(it's working good because logs are reaching the loghost - i ran it in debug mode so i was able to confirm that)

destination d_net { syslog("10.20.8.2" transport ("tcp") port(514) ); };

filter f_auth { facility(auth, authpriv) and not filter(f_debug); };

log { source(s_src); filter(f_auth); destination(d_net); };

and server (syslog-ng 3.2.5 - my server syslog-ng.conf part:

source s_network { tcp(); udp(); };

destination d_loghost_auth { file("/opt/logs/sys/$YEAR-$MONTH-$DAY/auth.log" create_dirs(yes) ); };

filter f_loghost_auth { facility(auth) or facility(authpriv) };

log { source(s_network); filter(f_loghost_auth); destination(d_loghost_auth); };

---

so when i run server in debug & verbose mode and test it with logger (from client):

logger -n 10.20.8.2 -p auth.info "auth.info test syslog"

i'm getting this:

Incoming log entry; line='95 <38>1 2014-12-17T13:03:16+01:00 ibanez logger - - [meta sequenceId="65"] auth.info test syslog'

Filter rule evaluation begins; filter_rule='f_loghost_auth'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='OR'

Filter rule evaluation result; filter_result='not-match', filter_rule='f_loghost_auth'

I don't think that version mismatch is the reason.
I will appreciate any kind of help!

logging syslog syslog-ng

share|improve this question

asked Dec 17 '14 at 12:14

mysteqmysteq

11

destination d_net { syslog("10.20.8.2" transport ("tcp") port(514) ); };

filter f_auth { facility(auth, authpriv) and not filter(f_debug); };

log { source(s_src); filter(f_auth); destination(d_net); };

source s_network { tcp(); udp(); };

destination d_loghost_auth { file("/opt/logs/sys/$YEAR-$MONTH-$DAY/auth.log" create_dirs(yes) ); };

filter f_loghost_auth { facility(auth) or facility(authpriv) };

log { source(s_network); filter(f_loghost_auth); destination(d_loghost_auth); };

logger -n 10.20.8.2 -p auth.info "auth.info test syslog"

Incoming log entry; line='95 <38>1 2014-12-17T13:03:16+01:00 ibanez logger - - [meta sequenceId="65"] auth.info test syslog'

Filter rule evaluation begins; filter_rule='f_loghost_auth'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='facility'

Filter node evaluation result; filter_result='not-match', filter_type='OR'

Filter rule evaluation result; filter_result='not-match', filter_rule='f_loghost_auth'

share|improve this question

asked Dec 17 '14 at 12:14

mysteqmysteq

11

share|improve this question

asked Dec 17 '14 at 12:14

mysteqmysteq

11

asked Dec 17 '14 at 12:14

mysteqmysteq

11

asked Dec 17 '14 at 12:14

mysteqmysteq

11

1 Answer
1

active

oldest

votes

0

The issue was that I used tcp() and udp() source driver [BSD format] instead of syslog() [IETF format]. It's working now.

share|improve this answer

answered Dec 17 '14 at 14:43

mysteqmysteq

11

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f653170%2fsyslog-ng-loghost-filter-not-match%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

The issue was that I used tcp() and udp() source driver [BSD format] instead of syslog() [IETF format]. It's working now.

share|improve this answer

answered Dec 17 '14 at 14:43

mysteqmysteq

11

add a comment | 

0

The issue was that I used tcp() and udp() source driver [BSD format] instead of syslog() [IETF format]. It's working now.

share|improve this answer

answered Dec 17 '14 at 14:43

mysteqmysteq

11

add a comment | 

The issue was that I used tcp() and udp() source driver [BSD format] instead of syslog() [IETF format]. It's working now.

share|improve this answer

answered Dec 17 '14 at 14:43

mysteqmysteq

11

share|improve this answer

answered Dec 17 '14 at 14:43

mysteqmysteq

11

answered Dec 17 '14 at 14:43

mysteqmysteq

11

answered Dec 17 '14 at 14:43

mysteqmysteq

11