HI,
Am currently using Syslog-ng to collect snmptraps.
My problem is that I amcurrently receiving traps from three
different networks and I have to filter them out.
I am receiving traps from 64.251.65.224/255.255.255.240
66.163.79.0/255.255.255.128
204.209.214.0/255.255.254.0
Where I want traps from 64.251.65.224/255.255.255.240 and 66.163.79.0/255.255.255.128
to be stored in one file
While traps from 204.209.214.0/255.255.254.0 in another.
Currently this is what my syslog-ng.conf looks like
And I am receiving nothing L
I am very frustrated with this.
Please help.
Thank you.
options {
long_hostnames(yes);
keep_hostname(yes);
use_fqdn(on);
create_dirs(yes);
owner(nmadmin);
group(users);
perm(0755);
dir_owner(nmadmin);
dir_group(users);
dir_perm(0755);
sync(0);
# The default action of syslog-ng 1.6.0 is to log a
STATS line
# to the file every 10 minutes. That's pretty ugly
after a while.
# Change it to every 12 hours so you get a nice
daily update of
# how many messages syslog-ng missed (0).
stats(43200);
};
source src{unix-stream("/dev/log"); internal();
pipe("/proc/kmsg"); };
destination messages { file("/var/log/messages");
};
filter f_messages { not level(warn); };
log { source(src); filter(f_messages);
destination(messages); };
#for SNMPTRAP
destination ipbb_lab_traps {
file("/store/ipbb_lab/traps/$YEAR-$MONTH-$DAY"); };
destination ipbb_traps {
file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); };
#filter snmptrap
filter f_testA { level(warn)and
netmask(64.251.65.224/255.255.255.240); };
filter f_testB { level(warn)and
netmask(66.163.79.0/255.255.255.128); };
log { source(src); filter(f_testA); destination(ipbb_traps);
};
log { source(src); filter(f_testB); destination(ipbb_traps);
};
filter f_test2 { level(warn)and
netmask(204.209.214.0/255.255.254.0); };
log { source(src); filter (f_test2);
destination(ipbb_lab_traps); };
From: syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] On
Behalf Of Frans Stekelenburg
Sent: Wednesday, August 03, 2005
5:27 AM
To: Syslog-ng users' and
developers' mailing list; ebroo@healthydirections.com
Subject: RE: [syslog-ng] syslog-ng-
filter() problem
try making another filter first with the
three filters and 'or' statements.
Sounds like your config creates an
and-and-and situation for you, leading in nothing beeing logged.
I think I came across this situation on
one of the helpful pages around (google), but unfortunatly don't remember
where, so I can't refer you to it.
regards,
frans