Filter events at the source

[dlukinski]

How to limit logs events sent by the source to the LOG server?
- is there way to send only Security logs or even event-type-based logs from the client to the LOG server?

Thank you

[jdalrymple]

This depends on the type of source, but almost always the answer is yes.

http://serverfault.com/questions/543494 ... sing-nxlog
http://www.rsyslog.com/sending-messages ... og-server/
http://www.ciscopress.com/articles/arti ... 8&seqNum=3

Be aware that if you don't send it to NLS, NLS can't help you retroactively resolve problems.

[dlukinski]

This depends on the type of source, but almost always the answer is yes.

http://serverfault.com/questions/543494 ... sing-nxlog
http://www.rsyslog.com/sending-messages ... og-server/
http://www.ciscopress.com/articles/arti ... 8&seqNum=3

Be aware that if you don't send it to NLS, NLS can't help you retroactively resolve problems.

This worked, thank you very much!

[rkennedy]

Glad to see this worked!

I will now close this thread out, but feel free to open another if you ever need assistance.