I'm tasked with auditing syslog messages from some network devices for suspicious activity. I can use the IN operator to extract the significant messages by message code.
Since some of these messages are legitimately generated by several management servers, I want to remove those messages from the report. Blocking all the messages created by the management servers is excessive and could potentially create a security risk. I'm trying to restrict the filtering for these management server to the messages that are legitimate part of their operation.
I can select the syslog messages of interest using the message code field and a list of message numbers using the "IN" operator.
I wanted to use the same logic to exclude the management servers using the logic in the form of a "NOT DEVICE_IP IN (192.168.1.10, 192.168.1.20, 192.168.1.30)"
Unfortunately, it doesn't work. What am I missing? Is there an equivalent function that will allow me to exclude a list of IP's?
