# syslog-ng and filter

**URL:** <https://forums.suse.com/t/syslog-ng-and-filter/25155>\
**Category:** SLES Configure-Administer\
**Created:** [February 18, 2014, 2:32pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155 "2014-02-18T14:32:24Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![krid](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@krid](https://forums.suse.com/u/krid)\
**Post date:** [February 18, 2014, 2:32pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/1 "2014-02-18T14:32:24Z")

</div>

I have a problem with my sylog-ng config file. I declare following lines:

```auto
source s_router {
        udp( port(514) );
};

destination d_router02 {
        file("/var/log/router/10.0.0.10" owner(root) group(users) perm(0640));
};

destination d_router03 {
        file("/var/log/router/10.0.0.11" owner(root) group(users) perm(0640));
};

destination d_router01 {
        file("/var/log/router/10.0.0.9" owner(root) group(users) perm(0640));
};

filter f_router01 { host("10.0.0.9"); };
filter f_router02 { host("10.0.0.10"); };
filter f_router03 { host("10.0.0.11"); };

log { source(s_router); filter(f_router01); destination(d_router01); };
log { source(s_router); filter(f_router02); destination(d_router02); };
log { source(s_router); filter(f_router03); destination(d_router03); };

```

but the result is that i have no entrys in the log file.  
If i delete the filter(f\_routerxx) entrys i have in all log files the same entrys!!

[UPDATE]  
My System is SLES11 SP2  
[/UPDATE]  
Regards  
Dirk

---

<div class="post-metadata">

**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\
**Post date:** [February 18, 2014, 4:47pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/2 "2014-02-18T16:47:34Z")

</div>

Hi Dirk,

> but the result is that i have no entrys in the log file.

might it be that your routers’ IP addresses resolve to a host name and thus the filter expression does not match? What’s the “host name” part when you disable the filter(s) and look at the log file?

BTW: Depending on your goals, you might want to take a completely different approach:

`source s_router { udp( port(514)); };
destination d_clients { file("/var/log/router/$HOST.log" owner(root) group(users) perm(0640)); };
log { source(s_remote); destination(d_clients); };`

would create a log file per remote client all by itself. Of course, if you have other remote clients logging to that syslog, you’d not get their log files into distinct directories.

Regards,  
Jens

---

<div class="post-metadata">

**Author:** ![krid](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@krid](https://forums.suse.com/u/krid)\
**Post date:** [February 19, 2014, 12:53pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/3 "2014-02-19T12:53:34Z")

</div>

Hi Jens,  
your suggestion works for me already, but now i want 3 different logfiles for my 3 router. And i hoped to solve this with the filter option.

Regards  
Dirk

---

<div class="post-metadata">

**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\
**Post date:** [February 19, 2014, 1:21pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/4 "2014-02-19T13:21:53Z")

</div>

[QUOTE=krid;19434]Hi Jens,  
your suggestion works for me already, but now i want 3 different logfiles for my 3 router. And i hoped to solve this with the filter option.

Regards  
Dirk[/QUOTE]

Hi Dirk,

I’m not sure I understand - first of all, _which_ of my suggestions works? Secondly, the “file(”/var/log/router/$HOST.log")" syntax is exactly intended to create a log file per remote client - which is what your routers are, from syslog-ng’s point of view.

To help you with your filtering, I’d need the requested information (sample output, to determine which value the host filter has to work against).

Regards,  
Jens

---

<div class="post-metadata">

**Author:** ![krid](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@krid](https://forums.suse.com/u/krid)\
**Post date:** [February 20, 2014, 12:10pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/5 "2014-02-20T12:10:20Z")

</div>

Hi Jens,  
here my Steps to save the Logfiles on th syslog-ng server.

1.Step i put simple lines in the syslog-ng

```auto
source s_router { udp( port(514)); };
destination d_router { file("/var/log/router/$HOST.log" owner(root) group(users) perm(0640)); };
log { source(s_remote); destination(d_router); };
```

The goal was one Logfile with the DNS name. The Problem is that this Router have 2 DNS Entrys. If i restart the syslog-ng service the name of the logfile is changing, i have the same result if i use logrotate… Now i have 2 logfiles for 1 router. This is the reason that i will use the ip address in the name of the logfile!

`source s_router { udp( port(514)); };
destination d_router { file("/var/log/router/10_0_0_1" owner(root) group(users) perm(0640)); };
log { source(s_remote); destination(d_router); };
`  
Now i have one logfile for my router! Thats work’s great.

But now i have 2 more router!  
I expand the lines above:

`source s_router { udp( port(514)); };
destination d_router01 { udp( (ip "10.0.0.1") port(514)); file("/var/log/router/10_0_0_1" owner(root) group(users) perm(0640)); };
destination d_router02 { udp( (ip "10.0.0.2") port(514)); file("/var/log/router/10_0_0_2" owner(root) group(users) perm(0640)); };
destination d_router03 { udp( (ip "10.0.0.3") port(514)); file("/var/log/router/10_0_0_3" owner(root) group(users) perm(0640)); };
log { source(s_remote); destination(d_router01); };
log { source(s_remote); destination(d_router02); };
log { source(s_remote); destination(d_router03); };
`  
Now the result is that i have 3 logfiles, with the same content!  
For this reason i expand the syslog-ng.conf with the filter option:

`source s_router { udp( port(514)); };
destination d_router01 { file("/var/log/router/10_0_0_1" owner(root) group(users) perm(0640)); };
destination d_router02 { file("/var/log/router/10_0_0_2" owner(root) group(users) perm(0640)); };
destination d_router03 { file("/var/log/router/10_0_0_3" owner(root) group(users) perm(0640)); };
filter f_router01 { host("10.0.0.1"); };
filter f_router01 { host("10.0.0.2"); };
filter f_router01 { host("10.0.0.3"); };
log { source(s_remote); filter(f_router01); destination(d_router01); };
log { source(s_remote); filter(f_router02); destination(d_router02); };
log { source(s_remote); filter(f_router03); destination(d_router03); };
`  
Now i have no logfiles! :mad: Its looks as if the filter option don’t works!

I hope i have shown my problem understandable!

Regards  
Dirk

---

<div class="post-metadata">

**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\
**Post date:** [February 20, 2014, 12:24pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/6 "2014-02-20T12:24:24Z")

</div>

Hi Dirk,

> I hope i have shown my problem understandable!

yes, indeed. I didn’t know about the alternating DNS names, leading to switching file names…

Your filter rules most probably won’t catch because (as I tried to express earlier on) it will filter against the _resolved host name_ - it seems to be a plain text filter, trying to match what syslog-ng determines to be the host section. So filtering for an IP address won’t get you anywhere - try to filter for what is reported as the host name(s) in the resulting syslog file.

To work against the “toggling DNS name” (which would affect filtering, too) you might consider to insert an IP/name pair into the syslogd’s /etc/hosts file and make sure that this file is checked first (via /etc/resolv.conf). I’ suspect that the routers’ DNS names won’t change that often, so adding that redundancy shouldn’t harm too much.

My recommendation would be to use the first version (using $HOST) after solving the toggling DNS entry issue.

Regards,  
Jens

PS: Your second sample might create a message loop, depending on the router’s configuration: "

```auto
destination d_router01 { udp( (ip "10.0.0.1") port(514)); file("/var/log/router/10_0_0_1" owner(root) group(users) perm(0640)); };
```

will send the messages received from the router(s) both to the file and to the router… the latter may then be forwarding the message back to the syslogd, and so on…

---

<div class="post-metadata">

**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\
**Post date:** [February 20, 2014, 12:35pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/7 "2014-02-20T12:35:36Z")

</div>

On 20/02/2014 10:14, krid wrote:  
[color=blue]

> here my Steps to save the Logfiles on th syslog-ng server.
> 
> 1.Step i put simple lines in the syslog-ng
> 
> ## Code:
> 
> source s\_router { udp( port(514)); };  
> destination d\_router { file(“/var/log/router/$HOST.log” owner(root) group(users) perm(0640)); };  
> log { source(s\_remote); destination(d\_router); };
> 
> * * *
> 
> The goal was one Logfile with the DNS name. The Problem is that this  
> Router have 2 DNS Entrys. If i restart the syslog-ng service the name of  
> the logfile is changing, i have the same result if i use logrotate.. Now  
> i have 2 logfiles for 1 router. This is the reason that i will use the  
> ip address in the name of the logfile!
> 
> ## Code:
> 
> ```
> source s_router { udp( port(514)); };
> 
> ```
> 
> destination d\_router { file(“/var/log/router/10\_0\_0\_1” owner(root) group(users) perm(0640)); };  
> log { source(s\_remote); destination(d\_router); };
> 
> * * *
> 
> Now i have one logfile for my router! Thats work’s great.
> 
> But now i have 2 more router!  
> I expand the lines above:
> 
> ## Code:
> 
> ```
> source s_router { udp( port(514)); };
> 
> ```
> 
> destination d\_router01 { udp( (ip “10.0.0.1”) port(514)); file(“/var/log/router/10\_0\_0\_1” owner(root) group(users) perm(0640)); };  
> destination d\_router02 { udp( (ip “10.0.0.2”) port(514)); file(“/var/log/router/10\_0\_0\_2” owner(root) group(users) perm(0640)); };  
> destination d\_router03 { udp( (ip “10.0.0.3”) port(514)); file(“/var/log/router/10\_0\_0\_3” owner(root) group(users) perm(0640)); };  
> log { source(s\_remote); destination(d\_router01); };  
> log { source(s\_remote); destination(d\_router02); };  
> log { source(s\_remote); destination(d\_router03); };
> 
> * * *
> 
> Now the result is that i have 3 logfiles, with the same content!  
> For this reason i expand the syslog-ng.conf with the filter option:
> 
> ## Code:
> 
> ```
> source s_router { udp( port(514)); };
> 
> ```
> 
> destination d\_router01 { file(“/var/log/router/10\_0\_0\_1” owner(root) group(users) perm(0640)); };  
> destination d\_router02 { file(“/var/log/router/10\_0\_0\_2” owner(root) group(users) perm(0640)); };  
> destination d\_router03 { file(“/var/log/router/10\_0\_0\_3” owner(root) group(users) perm(0640)); };  
> filter f\_router01 { host(“10.0.0.1”); };  
> filter f\_router01 { host(“10.0.0.2”); };  
> filter f\_router01 { host(“10.0.0.3”); };[/color]

For starters you’ve defined f\_router01 three times and not f\_router01,  
f\_router02, and f\_router03 as I think you intended based on following.  
[color=blue]

> log { source(s\_remote); filter(f\_router01); destination(d\_router01); };  
> log { source(s\_remote); filter(f\_router02); destination(d\_router02); };  
> log { source(s\_remote); filter(f\_router03); destination(d\_router03); };
> 
> * * *
> 
> Now i have no logfiles! :mad: Its looks as if the filter option don’t  
> works![/color]

I suspect the filter option is working but it’s not matching the  
hostname - try

filter f\_router01 { netmask(10.0.0.1/32); };  
filter f\_router02 { netmask(10.0.0.2/32); };  
filter f\_router03 { netmask(10.0.0.3/32); };

instead.

## HTH.

Simon  
SUSE Knowledge Partner

* * *

## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks.

---

<div class="post-metadata">

**Author:** ![krid](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@krid](https://forums.suse.com/u/krid)\
**Post date:** [February 20, 2014, 12:50pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/8 "2014-02-20T12:50:37Z")

</div>

Hi Jens,  
thanks for your explanation, i did not know that the filter only is a plain-text description . I change the /etc/hosts and the corresponding lines in the syslog-ng.conf and now it works!

Thanks and regards

Dirk

---

<div class="post-metadata">

**Author:** ![krid](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@krid](https://forums.suse.com/u/krid)\
**Post date:** [February 20, 2014, 2:34pm UTC](https://forums.suse.com/t/syslog-ng-and-filter/25155/9 "2014-02-20T14:34:59Z")

</div>

Hi Simon,  
thanks for your repy. I tested your solution to and it works also perfectly!

Regards  
Dirk