topic Re: How do you drop Logs completely with Syslog-NG from particular sources? in Getting Data In

How do you drop Logs completely with Syslog-NG from particular sources?

briant97 — Tue, 22 Sep 2015 16:58:21 GMT

With Syslog-NG how do you drop logs completely. I know how to create filters and what not but I don't know how to set the destination to drop completely.

Re: How do you drop Logs completely with Syslog-NG from particular sources?

frobert — Tue, 22 Sep 2015 17:39:26 GMT

Hi,

Create a log path that does not have a destination, just a source, a filter (that matches the messages you want to drop), and the final flag.
For details, see the syslog-ng Administrator Guide

Kind Regards,

Robert Fekete
syslog-ng documentation maintainer

Re: How do you drop Logs completely with Syslog-NG from particular sources?

briant97 — Wed, 23 Sep 2015 14:25:02 GMT

Can you show an example for future reference for others that may be wanting to do the same thing.

Re: How do you drop Logs completely with Syslog-NG from particular sources?

briant97 — Wed, 23 Sep 2015 14:26:13 GMT

Can you show an example of this just for others that may want to reference in the future.

Re: How do you drop Logs completely with Syslog-NG from particular sources?

frobert — Wed, 23 Sep 2015 14:29:19 GMT

Sure! (I've included a link in my earlier reply, but it seems it was moderated 🙂 )
The following log statement drops all debug level messages without any further processing.

filter demo_debugfilter { level(debug); };
log { source(s_all); filter(demo_debugfilter); flags(final); };

Re: How do you drop Logs completely with Syslog-NG from particular sources?

briant97 — Tue, 29 Sep 2020 07:19:52 GMT

filter f_new_networkdevices { netmask(192.168.2.1/32) or netmask(192.168.2.2/32); };
log { source(s_tcp_remote); filter(f_new_networkdevices); flags(final); }; #logs to no where without a destination
log { source(s_udp_remote); filter(f_new_networkdevices); flags(final); }; #logs to no where without a destination

I want to completely drop logs from these ips for now.

This is not working for me it is still logging.