topic Re: filtering cisco devices with syslog-ng.conf to avoid catchall in Getting Data In

filtering cisco devices with syslog-ng.conf to avoid catchall

agw — Thu, 16 Dec 2021 15:51:47 GMT

Hello-

I'm trying to filter cisco logs so that all data shows up in it's own folder in syslog-ng. However only some of the data is showing up and most of it is going to the catchall directory.

Cisco log messages start out with a %. When adding the asterisk to the filter it seems to ignore it. Here is a piece of the filter I use in the syslog-ng.conf:

filter f_cisco_ios { message("%AUTHMGR") or message("%DOT1X") or message("%MAB") or message("%LINK") or message("%LINE") or message("%DUAL") or message("%ISDN") or message("%EPM") or message("%OSPF") or message("%AUTHPRIV") or message("%LINEPROTO*") or message("%LINK*") };

I'm trying to get any messages with %LINK* to filter to the ciscoios folder but it keeps sending to the catchall directory. It seems like the syntax I am using is incorrect or maybe there is a better way to filter this without using "message" with filter.

Re: filtering cisco devices with syslog-ng.conf to avoid catchall

Stefanie — Tue, 21 Dec 2021 14:47:33 GMT

We use rsyslog, not syslog-ng. But we have it set up with multiple ports.

Our catchall is port 514 but we have multiple directories set up. We also have a directory for cisco-ios, cisco-asa and some other technologies. All ciscio-ios devices send its data on port 10520, all cisco-asa devices send it's data on port 10521, etc.

Depending on which port a system sends it's logs to the syslog server will dictate which folder it goes to.

That might be an easier way to set up your syslog server.

Re: filtering cisco devices with syslog-ng.conf to avoid catchall

agw — Wed, 22 Dec 2021 00:42:47 GMT

The original configuration was completed by Splunk support with syslog-ng a little over a year ago. I hadn't thought about using a different port for cisco devices but maybe that is something we could try. I changed things up on the syslog-ng.conf file and then everything was routing into the ciscoios folder, including palo alto data which I didn't want to happen so I changed things back to the partially working conf file.