What is the easiest way to exclude ingestion of events for a specific IP address at UF OR SyslogNG level?

[Nraj87]

Easiest way to exclude ingestion of events for a specific IP address from a SourceType at UF level OR Syslog-NG

[seemanshu]

Hi @Nraj87 ,

You could use one of the following methods for excluding the data from a specific IP in your infrastructure,

• Modifying syslog-ng.conf
  • filter f_all { not (<ip_address_to_be_excluded>);};

• Modifying transforms.conf and props.conf

in transforms.conf                 

[setnull]
 REGEX = <regex for the ip to be excluded>
 DEST_KEY = queue
 FORMAT = nullQueue

• in props.conf 

[sourcetype_name]
TRANSFORMS-null = setnull

Kindly support the answer, if find it useful.

Happy Splunking!

[woodcock]

The "easiest way" is almost never the "right way".  The "right way" is almost always to drop it as early in the transmission pipeline as possible.  So if syslog-ng, then do it with an IP filter in syslog-ng.  The easy way is to drop it at the indexer, but I would never do it that way.

[PickleRick]

Please be more specific about:

1) What your infrastructure and ingestion process looks like

2) What you want to do - filter out events coming from particuar IP? Containing particular IP? Something else?

[Nraj87]

1) What your infrastructure and ingestion process looks like - All the network devices are sending logs to SYSLOG-NG and from SYSLOGNG UF is forwarding the logs to the Indexers.

2) What you want to do - filter out events coming from particular IP?  yes, i would like to filter out all the events at UF level particular IP.          Containing particular IP?NA Something else?NA

[PickleRick]

So the easiest thing to do would be to (in order of decreasing reasonableness):

1) Not send the events from that IP

2) Configure your syslog-ng to silently discard events from that IP

3) Configure iptables on your syslog-ng host to reject/drop syslog packets from that IP

It has nothing to do with UF itself. It should be done before the events even reach the UF.