Technical data

Using Technician Interface Software
C-6
303561-A Rev 00
When you want Syslog to select and forward from all entities event messages that
satisfy severity and slot criteria that you specify, configure a filter for the wildcard
entity number (255).
Filtering by Event Number
Each event message generated by the router software has a unique message
number. (For a complete list of event message numbers, see Event Messages for
Routers.)
You can use event message numbers to specify an entity filter that selects only the
types of messages you want a remote host to receive.
You define a range of event message numbers for a router software entity by
specifying:
• An upper boundary number (MIB object wfSyslogFltrLogEvtUppBnd)
• A lower boundary number (MIB object wfSyslogFltrLogEvtLowBnd)
Syslog considers the upper and lower boundary values as part of the range.
For example, an entity filter for FTP has an event number range with a lower
boundary of 5 and an upper boundary of 27. With this filter, Syslog forwards to a
remote host FTP log messages with event numbers 5 to 27.
Note:
Although you assign each filter an index number manually through the
Technician Interface, Site Manager automatically assigns an index number to
each new filter you add to the configuration.
Note:
The wildcard filter is active for a host, only if there are no other entity
filters active for that host. If you configure and activate a filter for any entity
number other than 255, that filter takes precedence over the wildcard filter. The
wildcard filter transitions to the inactive state. The setting of the attribute
wfSyslogEntFltrOperState indicates the current operational state of any filter
instance you configure for a given host. (If wfSyslogEntFltrOperState = 1, the
filter is active; if wfSyslogEntFltrOperState = 2, the filter is inactive.)