filtering cisco devices with syslog-ng.conf to avoid catchall

[agw]

Hello- 

I'm trying to filter cisco logs so that all data shows up in it's own folder in syslog-ng.  However only some of the data is showing up and most of it is going to the catchall directory.  

Cisco log messages start out with a %.  When adding the asterisk to the filter it seems to ignore it.  Here is a piece of the filter I use in the syslog-ng.conf:

filter f_cisco_ios { message("%AUTHMGR") or message("%DOT1X") or message("%MAB") or message("%LINK") or message("%LINE") or message("%DUAL") or message("%ISDN") or message("%EPM") or message("%OSPF") or message("%AUTHPRIV") or message("%LINEPROTO*") or message("%LINK*") };

I'm trying to get any messages with %LINK* to filter to the ciscoios folder but it keeps sending to the catchall directory.  It seems like the syntax I am using is incorrect or maybe there is a better way to filter this without using "message" with filter. 

[Stefanie]

We use rsyslog, not syslog-ng. But we have it set up with multiple ports.

Our catchall is port 514 but we have multiple directories set up. We also have a directory for cisco-ios, cisco-asa and some other technologies. All ciscio-ios devices send its data on port 10520, all cisco-asa devices send it's data on port 10521, etc. 

Depending on which port a system sends it's logs to the syslog server will dictate which folder it goes to.

That might be an easier way to set up your syslog server. 

[agw]

The original configuration was completed by Splunk support with syslog-ng a little over a year ago.  I hadn't thought about using a different port for cisco devices but maybe that is something we could try.  I changed things up on the syslog-ng.conf file and then everything was routing into the ciscoios folder, including palo alto data which I didn't want to happen so I changed things back to the partially working conf file.