Antonio Brown wrote:
> Hello All,
>
> I was wondering which of the two formats below would you use when
> filtering using syslog-ng:
>
> filter f_pix { match(PIX) and not
> match(" 1.2.3.4|1.2.3.4|1.2.3.4|1.2.3.4|netmask("*MailScanner warning:
> numerical links are often malicious:*
> 1.2.3.4/28")|netmask("1.2.3.4/20")|netmask("1.2.3.4/22")|netmask("1.2.3.4/28")
> < http://1.2.3.4/28")|netmask("1.2.3.4/20")|netmask("1.2.3.4/22")|netmask("1.2.3.4/28")>")
> };
>
> or......
>
> filter f_pix { match(PIX)
> and not match(*MailScanner warning: numerical links are
> often malicious:* 1.2.3.4 <http://1.2.3.4>)
> and not match(*MailScanner warning: numerical
> links are often malicious:* 1.2.3.4 <http://1.2.3.4>)
> and not match(*MailScanner warning: numerical
> links are often malicious:* 1.2.3.4 <http://1.2.3.4>)
> and not match(*MailScanner warning: numerical
> links are often malicious:* 1.2.3.4 <http://1.2.3.4>)
> and not match(netmask("*MailScanner warning:
> numerical links are often malicious:* 1.2.3.4/28")) <http://1.2.3.4/28")) >
> and not match(netmask("*MailScanner warning:
> numerical links are often malicious:* 1.2.3.4/20")) <http://1.2.3.4/20")) >
> and not match(netmask("*MailScanner warning:
> numerical links are often malicious:* 1.2.3.4/22")) <http://1.2.3.4/22")) >
> and not match(netmask("*MailScanner warning:
> numerical links are often malicious:* 1.2.3.4/28")) <http://1.2.3.4/28")) >
> };
>
> I am currently using the latter, but it seems as if the individual ips
> and subnets would only be filtered if ALL is true. Would using "|", like
> in the first format, check for each individual ip or subnet and filter
> accordingly? When I say filter I mean, I would like everything except
> for the individual IPs and subnets specified. I am not certain that this
> is appropriate format for filtering subnets, please advise....
>
> Thank You, in advance for your assistance!!!
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> syslog-ng maillist - syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
the syntax for a 10.0.0.0/24 netmask is
netmask("10.0.0.0/255.255.255.0")
- Henning
_______________________________________________
syslog-ng maillist - syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html