Re: [gentoo-user] syslog-ng filtering

[Ralph Slooten]

Fantastic, you hit the nail right on the head! Works like a charm now.

Now I'm wondering how it is you found out that it was this way and not the
other? Robert maintains the documentation for rsync which I did look at, but
with 225 pages I wasn't able to find this useful piece of information. Man
syslog-ng.conf does not explain it either, in fact I searched Google and
found several "tutorials", none mentioning this ;-)

Maybe I'm the idiot here, however I thought that this was a common way of
getting rid of unwanted crud from the syslog?

Also, I just read the gentoo-wiki site page again and it says :

filter f_shorewall { not match("regex" value("Shorewall")); };  #
Filter everything except regex keyword Shorewall

Surely this is the exact same mistake I made? Either that or I'm reading it
wrong....





On 17 March 2010 23:39, Alan McKinnon <alan.mckinnon@×××××.com> wrote:

> On Wednesday 17 March 2010 01:22:59 Ralph Slooten wrote:
> > Hi all,
> >
> > Has anyone here worked out how to filter out syslog messages using
> > syslog-ng v3? The old syntax doesn't work (well complains bitterly about
> > performance and says to use regex), and no matter what I try I cannot get
> > the new syntax to work :-/ I have a syslog-ng server which logs to MySQL
> > for multiple clients in a network, however the database just keeps
> growing
> > with irrelevant data I'd prefer to just quietly ignore on the server
> side.
> >
> > I'm trying to filter out (exclude) messages such as:
> >   (root) CMD (/root/bin/vmware-checker)
> > and
> >   (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
> >
> > ==============
> > filter myfilter {
> >         not match("regex" value("\/usr\/sbin\/run-crons"))
> >         and not match("regex" value("vmware-checker"));
> > }
>
> Hah! this caught me out too.
>
> The value of "value" cannot be anything arbitrary - syslog-ng has no clue
> what
> you mean. The value is a field name, either a pre-defined one, or something
> you defined using a parser. The docs are ambiguous on this, it's not clear
> that the supplied values are abstracts. You are truing to search for the
> string "regex" in a field called /usr/bin/vmware-checker.
>
> Which obviously will not work.
>
> I think you want:
>
> match("\/usr\/sbin\/run-crons" value "MESSAGE")
>
> Note that it is MESSAGE. You want the field name, not it's dereferenced
> value.
>
>
>
> > log {
> >         source(src);
> >         source(remote);
> >         filter(myfilter);
> >         destination(d_mysql);
> > };
> > ===============
> >
> > However they just keep coming through the filter (ie: not matching the
> "not
> > match" filter). I've tried escaping the slashes, not escaping them ...
> even
> > partial words, but I obviously am missing something somewhere.
> >
> > Anyone have any ideas?
> >
> > Thanks in advance,
> > Ralph
>
> --
> alan dot mckinnon at gmail dot com
>