Syslog-ng filter message question
 

We have incoming logs from two edge firewalls, we want to filter individual lines of logs... with the following within our syslog-ng.conf

##logging
filter f_sendpage {
message("%ASA-5-722033") or message("%ASA-6-722022"); };

from there the captured logs should be sent to a perl script which emails it to joeblogs@google.com for example..

##logging
destination d_sendpage { program ("/usr/local/bin/sendmessage.pl"); };

Now unfortunately, this is not picking up the ASA id number. but it can pick up any other word within the line.

This is what the start of a line would look like:

Sep 26 00:04:44 10.200.101.253 %ASA-5-722033: Deny udp src INSIDE

Am I doing something wrong?

Let me know,

Thanks.

Is the % a special character? What if you just remove it?

Hi,

are you sure that the %ASA... part is parsed into the MESSAGE field? If the message is not 100% in syslog format, it might happen that syslog-ng interprets it as a program name. You can check it if you create a template and write a few such messages into a file with the selected fields.

BTW, newer syslog-ng versions have a built-in SMTP destination, so you mught not have to use a separate script.

Regards,

Robert

I'm not entirely sure if it is getting parsed, but it should do as it should read all incoming messages and send it to the perl mailer script just like it creates a .log file and stores it all within there. So there's two destinations but that would not cause an issue...

I've looked at swatch as a alternative and it works as intended, do you know of any others, with just basic functionality.

Thanks,
Jacob.

Try filtering on the program name instead of the message:

filter f_sendpage {
program("%ASA-5-722033") or program("%ASA-6-722022"); };

If that string is parsed as the programname, this filter should catch it.

Regards,

Robert