<p dir="ltr"><br>
On Feb 16, 2016 5:16 PM, "Scot" <<a href="mailto:scotrn@gmail.com">scotrn@gmail.com</a>> wrote:<br>
><br>
> Not easily without sending some sensitive data. <br>
><br>
> I take it the rule set logic seems correct then ? <br>
><br>
> This filter will remove data from both/either subnet from a message stream, <br>
> filter f_network {not netmask("<a href="http://192.168.238.0/24">192.168.238.0/24</a>") and not netmask("<a href="http://192.168.239.0/24">192.168.239.0/24</a>") ; }; <br><br></p>
<p dir="ltr">Yup</p>
<p dir="ltr">><br>
> These rules work in the same concatenation way ? <br>
> filter(f_network); filter(f_audit); filter(f_mcafee); destination (d_remote);<br></p>
<p dir="ltr">Filters are ANDed together. So all filters must match.<br>
><br>
><br>
> On Tue, Feb 16, 2016 at 9:28 AM, PÁSZTOR György <<a href="mailto:pasztor@linux.gyakg.u-szeged.hu">pasztor@linux.gyakg.u-szeged.hu</a>> wrote:<br>
>><br>
>> Hi,<br>
>><br>
>> "Scot" <<a href="mailto:scotrn@gmail.com">scotrn@gmail.com</a>> írta 2016-02-16 09:22-kor:<br>
>> > I'm still getting stuff on nmsloghost that I think should be filtered out.<br>
>><br>
>> Can you show us an example, which is forwarded to nmsloghost,<br>
>> but should be filtered out?<br>
>> A simple .pcap file, or "grep" or anything would be nice.<br>
>><br>
>> Cheers,<br>
>> Gyu<br>
>> ______________________________________________________________________________<br>
>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
>> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
>> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
>><br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
</p>