Splunk Search

Syslog filter for VMware data

MikeVenable
Path Finder

I am trying to make a filter that will filter out all VPXD, VPXA, and HOSTD data coming in from VM hosts. Below is excel sheet I use to define log use cases, green means I want to continue ingesting, yellow means I want to filter outalt text

Below is what the VPXA message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:09:53.295Z MyDomainName.com Vpxa: verbose vpxa[9164B70] [Originator@6876 sub=VpxaHalCnxHostagent opID=WFU-357897ba] Received WaitForUpdatesDone callback\0x0a

Below is what the HOSTD message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:13:31.559Z MyDomainName.com Hostd: verbose hostd[FFC1B70] [Originator@6876 sub=PropertyProvider] RecordOp ASSIGN: guest.disk, 40. Sent notification immediately.\0x0a

Below is my current filter in place, I filter on hostname, I still want to do this. I just want it to drop any message with the HOSTD or VPXA process and keep everything else.
alt text

Thanks for the help!

0 Karma
1 Solution

mansourireza
Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

mansourireza
Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...