Splunk Search

Syslog filter for VMware data

Path Finder

I am trying to make a filter that will filter out all VPXD, VPXA, and HOSTD data coming in from VM hosts. Below is excel sheet I use to define log use cases, green means I want to continue ingesting, yellow means I want to filter outalt text

Below is what the VPXA message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:09:53.295Z MyDomainName.com Vpxa: verbose vpxa[9164B70] [Originator@6876 sub=VpxaHalCnxHostagent opID=WFU-357897ba] Received WaitForUpdatesDone callback\0x0a

Below is what the HOSTD message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:13:31.559Z MyDomainName.com Hostd: verbose hostd[FFC1B70] [Originator@6876 sub=PropertyProvider] RecordOp ASSIGN: guest.disk, 40. Sent notification immediately.\0x0a

Below is my current filter in place, I filter on hostname, I still want to do this. I just want it to drop any message with the HOSTD or VPXA process and keep everything else.
alt text

Thanks for the help!

0 Karma
1 Solution

Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

Explorer

Try this:

syslog-ng version 2.1 and earlier :

filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");

syslog-ng versions newer than 2.1r:

 filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!