Service manual

159Appendix G Generating Alarm and Syslog
Cyclades-TS Installation & Service Manual
filter f_alert { level(alert); };
3. To filter by matching one string in the received message: filter f_match { match(“string”); };
Example to filter by matching the string “named”:
filter f_named { match(“named”); };
4. To filter ALARM messages:
filter f_alarm { facility(local[0+DB_facility]) and level(info) and match(“ALARM”) and match(“<your
string>”); } ;
Example to filter ALARM message with the string “kernel panic”:
filter f_kpanic { facility(local1) and level(info) and match(“ALARM”) and match(“kernel panic”); };
Example to filter ALARM message with the string “root login”:
filter f_root { facility(local1) and level(info) and match (“ALARM”) and match(“root login”); };
5. Example the filter to eliminate sshd debug messages
filter f_sshd_debug { not program(“sshd”) or not level(debug); };
6. To filter the syslog_buffering ;
filter f_syslog_buf { facility(local[0+<conf.DB_facility>]); };
To define actions use this statement:
destination <identifier> { destination-driver([params]); destination-driver([param]); ..};
where: identifier - has to uniquely identify this given destination.
destination-driver: it is a method of outputing a given message.
params: each destination-driver may take parameters, some of them required, some of them optional.
The following destination drivers are available:
a) file(filename [options])