<div>> Here is a part of my syslog-ng.conf, after some thorough research <br>> on the Cisco website:<br>><br>> #### {{{ Cisco, by device type<br>> filter f_cisco_router { facility(local2); };<br>> filter f_cisco_switch { facility(local3); };
<br>> filter f_cisco_firewall { facility(local4); };<br>> filter f_cisco_vpnbox { facility(local5); };<br>> #### Cisco, by device type }}}</div>
<div> </div>
<div>Keep in mind that if you have any other devices sending messages using the same facility as above, you may inadvertently filter those messages as well. You can match some text strings within the messages themselves or use a regex. Regex is more accurate but can have performance impact on busy syslog-ng server.
</div>
<div><br>Tom</div>