Logging server

[ecafracs]

Is it possible to filter the logs being sent by my network devices to the syslog servers.Like ports going up and down during workstation reboots or NIC going to sleep mode and waking up after receiveing magic packets (Wake up on LAN). What I would like to do is have my devices (switches/routers) send common logs, like ports going up and down , to my local syslog server, and send critical logs to the central syslog server.
any help is much appreciated.
Thanks!!!

 

[wybnormal]

Not on the router.. at least I have never heard or read of a way. You can have multiple syslog servers.. different facilities.. and you can filter out certain messages but I dont think you can send certain messages to certain servers. But, given that most syslog servers are Unix/Linux based, it's not that much effort to write a short script and use CRON to scan the logs each night.. X number of hours or whenever and strip out the enteries you dont want.

Just any idea.

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu

 

[lgarner]

You could also use something like Logdog (

http://freshmeat.net/projects/logdog)

to take action on the events that you do want.

Lee

 

[wybnormal]

Pretty cool utility

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu