I am trying to make a filter that will filter out all VPXD, VPXA, and HOSTD data coming in from VM hosts. Below is excel sheet I use to define log use cases, green means I want to continue ingesting, yellow means I want to filter out
Below is what the VPXA message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:09:53.295Z MyDomainName.com Vpxa: verbose vpxa[9164B70] [Originator@6876 sub=VpxaHalCnxHostagent opID=WFU-357897ba] Received WaitForUpdatesDone callback\0x0a
Below is what the HOSTD message looks when hitting port 514 on the the syslog server:
Msg: 2020-03-26T04:13:31.559Z MyDomainName.com Hostd: verbose hostd[FFC1B70] [Originator@6876 sub=PropertyProvider] RecordOp ASSIGN: guest.disk, 40. Sent notification immediately.\0x0a
Below is my current filter in place, I filter on hostname, I still want to do this. I just want it to drop any message with the HOSTD or VPXA process and keep everything else.
Thanks for the help!
Try this:
syslog-ng version 2.1 and earlier :
filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");
syslog-ng versions newer than 2.1r:
filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");
Try this:
syslog-ng version 2.1 and earlier :
filter f_faresx { match("far-esx" value("HOST")) and not match("vpxa") and not match("hostd");
syslog-ng versions newer than 2.1r:
filter f_faresx { match("far-esx" value("HOST")) and not message("vpxa") and not message("hostd");