[syslog-ng] Is this possible in syslog-ng.conf . (v2.0.2)

[Mr. James W. Laferriere]

 	Hello Balazs ,

On Sun, 18 Feb 2007, Balazs Scheidler wrote:
> On Sun, 2007-02-18 at 00:43 -0800, Mr. James W. Laferriere wrote:
>>  	Hello All ,  While I haven't seen any examples of this type of
>> definition of a 'source net' around I am hoping we can do something like ...
>>  	Not the formatting BUT the /24 &/or the netmask'ing .
>>
>> source net {
>>    udp(
>>      ip(
>>        199.33.245.0/24,	# or 199.33.245.0/255.255.255.0, ...
>>        205.141.166.0/24
>>      )
>>    port(514)
>>    );
>> };
>
> The source statement defines a listener and does not apply any filtering
> on incoming syslog datagrams.

 	Ok .  IMO counter intuitive ,  Tho reasonable with your explanation . 
One is very used to the 'source' in FW/router/...'s as being the source 
device(s) IP from where a packet came from .
 	An aside ,  Can one do the 'Formatting' like my example above ,  again 
no examples show up like that ,  but I am hopeful .


> To do that you need the netmask() filter.

 	Next time I'll go looking at the Blog at Gmane first before shooting my 
mouth off .  netmask was just the hint I needed .
 	Tho it sure would be nice for netmask() to support the /xx bits netmask 
format .
 		Tnx & Tia ,  JimL

-- 
+-----------------------------------------------------------------+
| James   W.   Laferriere | System   Techniques | Give me VMS     |
| Network        Engineer | 663  Beaumont  Blvd |  Give me Linux  |
| babydr at baby-dragons.com | Pacifica, CA. 94044 |   only  on  AXP |
+-----------------------------------------------------------------+