filter based on IP - catching other IPs? - syslog-ng - lists.balabit.hu

newer
syslog-ng incorrectly parsing...

filter based on IP - catching other IPs?

older
syslog-ng log processing

crayola＠optonline.net

7 Nov 2005 7 Nov '05

6:23 p.m.

I am running syslog-ng 1.6.8 as a central log host. everything is working great.. except for my filters. I want to filter all messages from 192.168.10.1 and 192.168.10.2 into other locations. Unfortunatly I seem to be catching other IP addresses in the filter below. Examples: 192.168.10.151, 192.168.10.197, 192.168.10.22 Is there anything I can do to make this filter more specific without resorting to regex. filter fw_only { ( host("192.168.10.1") or host("192.168.10.2") ); }; Thanks, Mike

Show replies by date

sawall

7 Nov 7 Nov

6:28 p.m.

have you tried putting a "\b" at the end to set the boundary? host("192.168.10.2\b") just a thought. chris On 11/7/05, crayola@optonline.net <crayola@optonline.net> wrote:

I am running syslog-ng 1.6.8 as a central log host. everything is working great.. except for my filters.

I want to filter all messages from 192.168.10.1 and 192.168.10.2 into other locations.

Unfortunatly I seem to be catching other IP addresses in the filter below. Examples: 192.168.10.151, 192.168.10.197, 192.168.10.22

Is there anything I can do to make this filter more specific without resorting to regex.

filter fw_only { ( host("192.168.10.1") or host("192.168.10.2") ); };

Thanks, Mike

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

Henning Markussen

6:59 p.m.

have you tried putting a "\b" at the end to set the boundary?

host("192.168.10.2\b")

just a thought.

chris

On 11/7/05, crayola@optonline.net <crayola@optonline.net> wrote:

...
I am running syslog-ng 1.6.8 as a central log host. everything is working great.. except for my filters.

I want to filter all messages from 192.168.10.1 and 192.168.10.2 into other locations.

Unfortunatly I seem to be catching other IP addresses in the filter below. Examples: 192.168.10.151, 192.168.10.197, 192.168.10.22

Is there anything I can do to make this filter more specific without resorting to regex.

filter fw_only { ( host("192.168.10.1") or host("192.168.10.2") ); };

Thanks, Mike

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

Hi Just use host("192.168.10.1$") or host("192.168.10.2$") - Henning

Crayola

8 Nov 8 Nov

2:45 a.m.

Thanks all.. Henning's sugestion to put a $ at the end solved it. Mike

...
have you tried putting a "\b" at the end to set the boundary?

host("192.168.10.2\b")

Just use

host("192.168.10.1$") or host("192.168.10.2$")

- Henning

7228

Age (days ago)

7229

Last active (days ago)

Download

3 comments

4 participants

tags

participants (4)

Crayola
crayola＠optonline.net
Henning Markussen
sawall