Configuring filter on Linux host side for syslogs

[SuryanuSanyal]

Hi team,

There's a requirement for configuring filters or patterns using regex pattern on linux host from which we are receiving syslogs to nagios log server.
Kindly let me know which file we can configure on linux host for filtration provided that we are not using NXLog agent.

Thanks in advance.

[gsmith]

Hi,

Instead of using NXlog, rsyslog or syslog-ng can be used on a remote host.

Rsyslog is an open-source software utility used on UNIX and Unix-like computer systems for forwarding log messages in an IP network. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, queued operations to handle offline outputs, support for different module outputs, flexible configuration options and adds features such as using TCP for transport.

syslog-ng is a free and open-source implementation of the syslog protocol for Unix and Unix-like systems. It extends the original syslogd model with content-based filtering, rich filtering capabilities, flexible configuration options and adds important features to syslog, like using TCP for transport. As of today,[when?] syslog-ng is developed by Balabit IT Security Ltd. It has three editions with a common codebase. The first is called syslog-ng Open Source Edition (OSE) with the license LGPL. The second is called Premium Edition (PE) and has additional plugins (modules) under a proprietary license. The third is called Storebox (SSB), which comes as an appliance with a Web-based UI as well as additional features including ultra-fast-text search, unified search, content-based alerting and a premier tier support.

Does this answer your question?

Thanks