[syslog-ng] Linux or OS fingerprint filter

[Fabien Wernli]

On Wed, Mar 28, 2018 at 12:29:00PM -0400, Scot wrote:
> Pretty sure I know the answer but just maybe..
> 
> 
> Anyone have a solution OS fingerprint type filters ?
> Solaris, Linux vs Cisco for example.
> 
> Immediate need is to pluck all Linux host from 514.

FWIW we use facter (puppet) to add this kind of information as RFC5424
key/values to every outgoing message.