<div dir="ltr"><div><div><div><div>Hi,<br></div><br>You could use the inlist() filter. In this case the configuration is simple and host names are listed in a separate file.<br><br></div>Blog about a similar use-case: <a href="https://czanik.blogs.balabit.com/2013/09/black-cat-white-cat/">https://czanik.blogs.balabit.com/2013/09/black-cat-white-cat/</a><br></div>Documentation: <a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.9-guides/en/syslog-ng-ose-v3.9-guide-admin/html-single/index.html#filter-inlist">https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.9-guides/en/syslog-ng-ose-v3.9-guide-admin/html-single/index.html#filter-inlist</a><br><br></div>Bye,<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>Balabit / syslog-ng upstream<br><a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/author/peterczanik/</a><br><a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div></div></div></div>
<br><div class="gmail_quote">On Fri, Jun 9, 2017 at 3:50 AM, Jim Hendrick <span dir="ltr"><<a href="mailto:james.r.hendrick@gmail.com" target="_blank">james.r.hendrick@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:14px">For VP:</span><div><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:14px"><br></span></div><div><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:14px">filter f_netmask { netmask("<a href="http://10.80.2.0/24" target="_blank">10.80.2.0/24</a>"); };</span></div><div><font face="Arial, Helvetica, sans-serif" color="#333333"><span style="font-size:14px"><br></span></font></div><div><font face="Arial, Helvetica, sans-serif" color="#333333"><span style="font-size:14px">Another tip we have used successfully is to include a separate file with the list of hosts / netmask filters and maintain it separately from the base syslog-ng.conf</span></font></div><div><font face="Arial, Helvetica, sans-serif" color="#333333"><span style="font-size:14px"><br></span></font></div><div><pre style="color:rgb(0,0,0)">include "/etc/syslog-ng/filter-defs.<wbr>inc";</pre><pre style="color:rgb(0,0,0)">You still need to write the filters, but it makes the overall file simpler.</pre><span class="HOEnZb"><font color="#888888"><pre style="color:rgb(0,0,0)"><br></pre><pre style="color:rgb(0,0,0)">Jim</pre><div><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:14px"><br></span></div><div><span style="color:rgb(51,51,51);font-family:Arial,Helvetica,sans-serif;font-size:14px"><br></span></div></font></span></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 8, 2017 at 7:57 PM, Scot <span dir="ltr"><<a href="mailto:scotrn@gmail.com" target="_blank">scotrn@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">On that note is there a better way to handle a static host list for a filter like VP needs? <div><br></div><div>I'm using the same method but fully qualified host match. I need to send about 20 hosts logs to a specific destination. </div><div>They do not match any unique header. I cannot say all "ASA" because only some need to go and not all sources are ASA or even on the same subnet.</div><div><br></div><div>Seems to work ok but ugly as hell having "host or host or host or ...." in a filter. </div><div><br></div><div>Thanks </div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 6, 2017 at 10:32 AM, <a href="mailto:wiskbroom@hotmail.com" target="_blank">wiskbroom@hotmail.com</a> <span dir="ltr"><<a href="mailto:wiskbroom@hotmail.com" target="_blank">wiskbroom@hotmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif" dir="ltr">
<p>Can you provide an example?</p>
<p><br>
</p>
<p>Thank you,<br>
</p>
<p><br>
</p>
<div id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543Signature">VP</div>
</div>
<hr style="display:inline-block;width:98%">
<div id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balab<wbr>it.hu</a>> on behalf of james.r.hendrick <<a href="mailto:james.r.hendrick@gmail.com" target="_blank">james.r.hendrick@gmail.com</a>><br>
<b>Sent:</b> Tuesday, June 6, 2017 8:31:39 AM<span><br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
</span><span><b>Subject:</b> Re: [syslog-ng] Filter Not Working (too many or's?)</span></font>
<div> </div>
</div><span>
<div>
<div>Not exactly what you asked but I have used netmask to simplify some filters. Although it probably won't be able to solve your problem. </div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543composer_signature">
<div style="font-size:85%;color:#575757" dir="auto">Sent from my Verizon, Samsung Galaxy smartphone</div>
</div>
<div><br>
</div>
<div style="font-size:100%;color:#000000">
<div>-------- Original message --------</div>
<div>From: "Szalai, Attila" <<a href="mailto:Attila.Szalai@morganstanley.com" target="_blank">Attila.Szalai@morganstanley.c<wbr>om</a>> </div>
<div>Date: 6/6/17 8:07 AM (GMT-05:00) </div>
<div>To: Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>>
</div>
<div>Subject: Re: [syslog-ng] Filter Not Working (too many or's?) </div>
<div><br>
</div>
</div>
<p></p>
<div class="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Hi,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">First of all, the content of the host() is a regular expression, so adding .* to the beginning and/or to the end of the expression adds nothing, just pain/slowness.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Second, it would help a lot if we can see the actual error message. I found no obvious mistake, but because this is not the original line, maybe something lost
in the translation.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> syslog-ng [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@list<wbr>s.balabit.hu</a>]
<b>On Behalf Of </b><a href="mailto:wiskbroom@hotmail.com" target="_blank">wiskbroom@hotmail.com</a><br>
<b>Sent:</b> Tuesday, June 06, 2017 12:59 AM<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> [syslog-ng] Filter Not Working (too many or's?)<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543divtagdefaultwrapper">
<p><span style="font-family:"Calibri","sans-serif";color:black">Here is an example of what I am trying to do, these hostnames are not real; the real ones have no common pattern.<u></u><u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">filter f_xyz { host("*.abca.*") or host(".*abcb.*") or host(".*abcc.*") or host(".*abcd.*") or host(".*abce.*") or host(".*abcf.*") or host(".*abcg.*") or host(".*abch.*"); };<u></u><u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">The filter above is for any host containing a hostname with what is contained within the .* and *.; i.e. hostabca01 will be matched by host("*.abca.*")
<u></u><u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">When I have this filter in my config, syslog fails to restart.<u></u><u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><u></u> <u></u></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">Eyes hurt, obvious mistake?<u></u><u></u></span></p>
</div>
</div>
</div>
<br>
<br>
<hr id="m_-8134121846263839361m_-6096100300615729945m_3464764435700967543HR1">
<br>
<span style="FONT-SIZE:7.5pt;FONT-FAMILY:Arial;COLOR:#808080">NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975
of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or
privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: <a href="http://www.morganstanley.com/disclaimers" target="_blank">http://www.morganstanley.com/d<wbr>isclaimers</a> If you cannot access
these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.</span><br>
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
</div>
</span></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
</div></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>