[syslog-ng]Writing a custom filter

Richard E. Perlotto II syslog-ng@lists.balabit.hu
Sun, 2 Mar 2003 16:57:16 -0800


This is a multi-part message in MIME format.

------=_NextPart_000_006A_01C2E0DC.CAE30DE0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit

Take a look at my config file at:
 
ftp://ftp.cataphract.com/syslog/syslog-ng/syslog-ng/syslog-ng-1.6.0rc1/s
yslog-ng.conf
 
I added a lot of comments related to how to build filtering in
syslog-ng.  The documentation
is very short on the subject matter.
 
 
 
Richard

-----Original Message-----
From: syslog-ng-admin@lists.balabit.hu
[mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Rohit Dewan
Sent: Sunday, March 02, 2003 2:09 PM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng]Writing a custom filter



What is the best way to write a custom filter for syslog-ng? Any
pointers would be most appreciated.

 

Thanks,

Rohit


------=_NextPart_000_006A_01C2E0DC.CAE30DE0
Content-Type: text/html;
	charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<TITLE>Message</TITLE>

<META content=3D"MSHTML 6.00.2800.1141" name=3DGENERATOR>
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in =
1.25in; }
P.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
	COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
	COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
	COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
	COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
	COLOR: windowtext; FONT-FAMILY: Arial
}
DIV.Section1 {
	page: Section1
}
</STYLE>
</HEAD>
<BODY lang=3DEN-US vLink=3Dpurple link=3Dblue>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =
size=3D2>Take a=20
look at my config file at:</FONT></SPAN></DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =
size=3D2><A=20
href=3D"ftp://ftp.cataphract.com/syslog/syslog-ng/syslog-ng/syslog-ng-1.6=
.0rc1/syslog-ng.conf">ftp://ftp.cataphract.com/syslog/syslog-ng/syslog-ng=
/syslog-ng-1.6.0rc1/syslog-ng.conf</A></FONT></SPAN></DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =
size=3D2>I=20
added a lot of comments related to how to build filtering in =
syslog-ng.&nbsp;=20
The documentation</FONT></SPAN></DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =
size=3D2>is=20
very short on the subject matter.</FONT></SPAN></DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D839155500-03032003><FONT face=3DArial color=3D#0000ff =

size=3D2>Richard</FONT></SPAN></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid; MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
  face=3DTahoma size=3D2>-----Original Message-----<BR><B>From:</B>=20
  syslog-ng-admin@lists.balabit.hu =
[mailto:syslog-ng-admin@lists.balabit.hu]=20
  <B>On Behalf Of </B>Rohit Dewan<BR><B>Sent:</B> Sunday, March 02, 2003 =
2:09=20
  PM<BR><B>To:</B> syslog-ng@lists.balabit.hu<BR><B>Subject:</B>=20
  [syslog-ng]Writing a custom filter<BR><BR></FONT></DIV>
  <DIV class=3DSection1>
  <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
  style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">What is the best way to =
write a=20
  custom filter for syslog-ng? Any pointers would be most=20
  appreciated.</SPAN></FONT></P>
  <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
  style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial"></SPAN></FONT>&nbsp;</P>
  <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
  style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">Thanks,</SPAN></FONT></P>
  <P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
  style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial">Rohit</SPAN></FONT></P></DIV></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_006A_01C2E0DC.CAE30DE0--