Configuring and debugging the free-style filter

Free-style filters allow users to define a filter for logs that are captured to each individual logging device type. Filters can include log categories and specific log fields. The filters can be created as an inclusive list or exclusive list.

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter
    set filter <string>
    set filter-type {include | exclude}
end

filter <string>

Enter the syslog filter criterion. The following options are available: logid(...), traffic-level(...), event-level(...), virus-level(...), webfilter-level(...), ips-level(...), emailfilter-level(...), anomaly-level(...), voip-level(...), dlp-level(...), app-ctrl-level(...), waf-level(...), gtp-level(...), dns-level(...), ssh-level(...), ssl-level(...), cifs-level(...), file-filter-level(...), and icap-level(...).

Multiple values can be added for logid.

For example:

set filter "logid(<id>,<id>)"

set filter "event-level({emergency | alert | critical | error | warning | notice | information | debug})"

filter-type {include | exclude}

Include/exclude logs that match the filter.

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

To configure the syslogd filter with multiple values:

In this example, the free-style filter is set to filter log IDs 0102043039 or 0102043040.

config log syslogd filter
    set filter "logid(0102043039,0102043040)"
end

To configure the syslogd filter with multiple options:

In this example, the free-style filter is set to filter log ID 0102043039 or logs at and above the notice severity level.

config log syslogd filter
    set filter "event-level(notice) logid(0102043039)"
end

The filter <string> setting applies a logical OR to the multiple values or options specified.

To view the syslogd free-style filter results:

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

# execute log filter free-style "logid 0102043039 0102043040"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: logid 0102043039 0102043040
Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)
Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))

Configuring and debugging the free-style filter

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter
    set filter <string>
    set filter-type {include | exclude}
end

filter <string>

Multiple values can be added for logid.

For example:

set filter "logid(<id>,<id>)"

set filter "event-level({emergency | alert | critical | error | warning | notice | information | debug})"

filter-type {include | exclude}

Include/exclude logs that match the filter.

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

To configure the syslogd filter with multiple values:

In this example, the free-style filter is set to filter log IDs 0102043039 or 0102043040.

config log syslogd filter
    set filter "logid(0102043039,0102043040)"
end

To configure the syslogd filter with multiple options:

In this example, the free-style filter is set to filter log ID 0102043039 or logs at and above the notice severity level.

config log syslogd filter
    set filter "event-level(notice) logid(0102043039)"
end

The filter <string> setting applies a logical OR to the multiple values or options specified.

To view the syslogd free-style filter results:

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

# execute log filter free-style "logid 0102043039 0102043040"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: logid 0102043039 0102043040
Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)
Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))

Administration Guide

Configuring and debugging the free-style filter

Configuring and debugging the free-style filter

To configure the syslogd filter with multiple values:

To configure the syslogd filter with multiple options:

To view the syslogd free-style filter results:

Configuring and debugging the free-style filter

To configure the syslogd filter with multiple values:

To configure the syslogd filter with multiple options:

To view the syslogd free-style filter results: