Solved: logging discriminator issue

dakahn · ‎02-23-2015

I have read through the community and cannot find a example of what I am trying to do. I am trying to drop all syslog messages that have the message type "GDOI" see below for example. I have tried the following commands but still see them in logs and they are showing up on our syslog server as well. I am more interested in not seeing them in my syslog server but dont care if I am logged into router and see them.

commands used..

logging discriminator NoGD msg-body drops GDOI
logging buffered discriminator NoGD
logging console discriminator NoGD
logging monitor discriminator NoGD

SYSLOG message trying to drop

Feb 24 01:11:36.891 UTC: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
Feb 24 01:11:36.891 UTC: %GDOI-5-GM_RECV_REKEY: Received Rekey for group GETVPN from 10.16.98.107 to 10.92.255.254 with seq # 7
Feb 24 01:11:36.895 UTC: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.16.98.107 for group GETVPN-ChinaWANGroup & gm identity 10.92.255.254

Dan Frey · ‎02-24-2015

GDOI is in the "facility" field of the syslog and not the msg-body.

View solution in original post

Dan Frey · ‎02-25-2015

Attach the discriminator to your syslog host.

logging host 10.1.1.1 discriminator NoGD

View solution in original post

Dan Frey · ‎02-24-2015

GDOI is in the "facility" field of the syslog and not the msg-body.

dakahn · ‎02-25-2015

Thank you for clarifying that. Seems now its working correctly. I understand that the logging buffered is how the syslogs get saved locally but I was wondering if their was a way to allow it to still been seen locally but not sent to the syslog server?

Thanks!

Dan Frey · ‎02-25-2015

Attach the discriminator to your syslog host.

logging host 10.1.1.1 discriminator NoGD

dakahn · ‎02-25-2015

Daniel,

Perfect.. One last question. If I wanted to add more to the filter list, I.E msg-body etc, can I add it to the existing discriminator? Can I have more than 1 discriminator set to syslog server?

Dan Frey · ‎02-25-2015

Additional fields can be appended to the discriminator statement and only one discriminator can be applied to the destination (monitor, console, host, ect..).

If you wanted to only drop logs with facility of "SYS" that also has the msg-body of "user"

logging discriminator myfilter facility includes SYS msg-body drops user

The order of operation when using multiple filters is explained here: http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html