[syslog-ng] Quick filter question

Lay, James james.lay at wincofoods.com
Tue Nov 8 16:15:54 CET 2011


Hey all!

 

Real quick...trying to filter OUT firewall hits that have say...169.254.
Will this do the trick?

 

filter f_firewall {

        not program (firewall flags(ignore-case));

        and not message("169\.254\.[0-9]+\.[0-9]+");

};

 

Thanks all.

 

James

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20111108/fa974a59/attachment-0001.htm 


More information about the syslog-ng mailing list