Splunk Search

Syslog filter for VMware data

MikeVenable
Path Finder

I am trying to make a filter that will filter out all VPXD, VPXA, and HOSTD data coming in from VM hosts. Below is excel sheet I use to define log use cases, green means I want to continue ingesting, yellow means I want to filter outalt text

Below is what the VPXA message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:09:53.295Z MyDomainName.com Vpxa: verbose vpxa[9164B70] [Originator@6876 sub=VpxaHalCnxHostagent opID=WFU-357897ba] Received WaitForUpdatesDone callback\0x0a

Below is what the HOSTD message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:13:31.559Z MyDomainName.com Hostd: verbose hostd[FFC1B70] [Originator@6876 sub=PropertyProvider] RecordOp ASSIGN: guest.disk, 40. Sent notification immediately.\0x0a

Below is my current filter in place, I filter on hostname, I still want to do this. I just want it to drop any message with the HOSTD or VPXA process and keep everything else.
alt text

Thanks for the help!

0 Karma
1 Solution

mansourireza
Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

mansourireza
Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...