topic How to blacklist server from heavy forwarder? in Getting Data In

How to blacklist server from heavy forwarder?

YungLee — Fri, 10 Feb 2023 19:01:50 GMT

Currently my Heavy Forwarder is receiving unwanted logs from a lot of different devices, and it is taking up a lot of space.

Is there a way to prevent / reject logs from all servers, and manually add server logs that we want to monitor into whitelist, so that it doesn't take up free space in my Heavy Forwarder.

So basically, reject all logs from all server.

Accept logs only from server1 and server2.

Thank you in advance.

Re: Blacklist server from heavy forwarder

SanjayReddy — Fri, 10 Feb 2023 09:55:08 GMT

Hi @YungLee

you can use

acceptFrom in inputs.conf of HF to allow data from specfic hosts

Re: Blacklist server from heavy forwarder

YungLee — Mon, 13 Feb 2023 01:46:27 GMT

Hi @SanjayReddy ,

Thank you for your reply.

Just a additional question.

Does using the above configuration mean that the syslog will not enter or be stored in the Heavy Forwarder Linux machine's /var/log?

Thank you.