On Feb 16, 2016 5:16 PM, "Scot" <scotrn@gmail.com> wrote:
Not easily without sending some sensitive data.
I take it the rule set logic seems correct then ?
This filter will remove data from both/either subnet from a message
stream,
filter f_network {not netmask("192.168.238.0/24") and not netmask(" 192.168.239.0/24") ; };
Yup
These rules work in the same concatenation way ? filter(f_network); filter(f_audit); filter(f_mcafee); destination
(d_remote); Filters are ANDed together. So all filters must match.
On Tue, Feb 16, 2016 at 9:28 AM, PÁSZTOR György <
pasztor@linux.gyakg.u-szeged.hu> wrote:
Hi,
"Scot" <scotrn@gmail.com> írta 2016-02-16 09:22-kor:
I'm still getting stuff on nmsloghost that I think should be filtered
out.
Can you show us an example, which is forwarded to nmsloghost, but should be filtered out? A simple .pcap file, or "grep" or anything would be nice.
Cheers, Gyu
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq