syslog question

[dandan123]

Some cisco devices are logging messags using local7 .

I want to be able to separate out (in real time) these messages based on searching for certain strings inside the messages.

Any ideas how to go about doing this ?

 

[dandan123]

Come on now you guys must know how to do this .

 

[SamBones]

[tt]man syslog.conf[/tt]

Look for the examples toward the end.

Hope this helps.

 

[alphaville]

Try SEC - Simple Event Correlator

http://www.estpak.ee/~risto/sec/

Use a log file as input and sec will filter on certain regex conditions.

 

[ksas025]

Syslog-ng is able to do this in a snap using filter rules.

I forget the web page. Just google syslog-ng; tons of info.

 

[dandan123]

I'd forgotten about this thread, but anyway after some googling I came across syslog-ng and I've implemented it on a server, still testing.