Syslog filter for VMware data

[MikeVenable]

I am trying to make a filter that will filter out all VPXD, VPXA, and HOSTD data coming in from VM hosts. Below is excel sheet I use to define log use cases, green means I want to continue ingesting, yellow means I want to filter out

Below is what the VPXA message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:09:53.295Z MyDomainName.com Vpxa: verbose vpxa[9164B70] [Originator@6876 sub=VpxaHalCnxHostagent opID=WFU-357897ba] Received WaitForUpdatesDone callback\0x0a

Below is what the HOSTD message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:13:31.559Z MyDomainName.com Hostd: verbose hostd[FFC1B70] [Originator@6876 sub=PropertyProvider] RecordOp ASSIGN: guest.disk, 40. Sent notification immediately.\0x0a

Below is my current filter in place, I filter on hostname, I still want to do this. I just want it to drop any message with the HOSTD or VPXA process and keep everything else.

Thanks for the help!

[mansourireza · Accepted solution]

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...