[syslog-ng]regex and priority(local7) question

[cdowns]

Ted,
    Thank you for the reply, Ill give this a try.

Sincerely,
    Christopher M Downs

Rule, Ted wrote:

>This config snippet works for me .... my PIXies are set to log via TCP1468 rather than UDP/514.
>Real IP Addresses replaced with fakes. As with your situation, I have other network
>gear running on local7 as well. Syslog-ng's wonderful filtration allows for a nice separation
>of all the classes of switch/router/firewall/VPN-bricks.
>
>
>Ted
>
>......
>source local {
>        unix_stream("/dev/log" max-connections(200) keep-alive(yes) );
>
>        # UDP listeners for Internal syslog-ng interconnections
>        udp(ip(127.0.0.1) port(514));
>        udp(ip(1.2.3.4) port(514));
>
>};
>
>source pixtcp {
>        tcp(ip(1.2.3.4) port(1468)
>                max-connections(10) keep-alive(yes));
>};
>
>filter f_local7 { facility(local7) and level(debug..emerg); };
>filter f_pixmsg { match("%PIX"); };
>filter f_misclocal7 { filter(f_local7)
>                        and not filter(f_pixmsg); };
>
>destination d_local7 { file("/var/log/local7.debug" sync(0) ); };
>destination d_pixlog { file("/var/log/pixlog.debug" sync(0) ); };
>
>log { source(pixtcp);
>        filter(f_local7); filter(f_pixmsg); destination(d_pixlog); };
>log { source(local); filter(f_misclocal7); destination(d_local7); };
>
>......
>
>
>  
>
>>-----Original Message-----
>>From: syslog-ng-admin@lists.balabit.hu 
>>[mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of cdowns
>>Sent: Monday 01 March 2004 17:11
>>To: syslog-ng@lists.balabit.hu
>>Subject: [syslog-ng]regex and priority(local7) question
>>
>>
>>Good Morning,
>>    Im new to the list and have a couple questions.
>>
>>    I have a PIX firewalls logging on local7.info, how can I 
>>match this 
>>correctly ? I also have switches logging on local7.info but I 
>>need this 
>>one pix removed and placed into its own destination.
>>
>>    Where can i get a list of the regex syntax used in 
>>syslog-ng ? like 
>>perl / awk / grep etc.. .
>>
>>    Here is what I currently have:
>>
>>------ Snip -------
>>    ## Regex
>>filter f_fw01 {
>>        host("x.x.x.x") and match("PIX");
>>};
>>filter f_fw02 {
>>        host("x.x.x.x") and match("PIX");
>>};
>>filter f_fw03 {
>>        host("x.x.x.x") and match("PIX");
>>};
>>filter f_fw04 {
>>        host("x.x.x.x") and match("PIX");
>>};
>>
>>#!!! not working yet.. .
>>filter f_pix{
>>        facility(local7) and match("%PIX*");
>>};
>>       
>>filter f_iss {
>>        match("issDaemon");
>>};
>>filter f_snmp {
>>        match("ucd-snmp");
>>};
>>
>>## everything else incoming
>>filter f_local7 { facility(local7); };
>>
>>
>>----- snip ------
>>
>>TIA.
>>
>>~!>D
>>_______________________________________________
>>syslog-ng maillist  -  syslog-ng@lists.balabit.hu
>>https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>>
>>
>>    
>>
>
>
>************************************************************************************************
>This E-mail message, including any attachments, is intended only for the person
>or entity to which it is addressed, and may contain confidential information.
>If you are not the intended recipient, any review, retransmission, disclosure,
>copying, modification or other use of this E-mail message or attachments is
>strictly forbidden.
>If you have received this E-mail message in error, please contact the author and
>delete the message and any attachments from your computer.
>You are also advised that the views and opinions expressed in this E-mail
>message and any attachments are the author's own, and may not reflect the views
>and opinions of FLEXTECH Television Limited.
>************************************************************************************************
>
>_______________________________________________
>syslog-ng maillist  -  syslog-ng@lists.balabit.hu
>https://lists.balabit.hu/mailman/listinfo/syslog-ng
>Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>
>  
>