Configuring and debugging the free-style filter

Free-style filters allow users to define a filter for logs that are captured to each individual logging device type. Filters can include log categories and specific log fields. The filters can be created as an inclusive list or exclusive list.

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter
    set filter <string>
    set filter-type {include | exclude}
end

filter <string>

Enter the syslog filter criterion. The following options are available: logid(...), traffic-level(...), event-level(...), virus-level(...), webfilter-level(...), ips-level(...), emailfilter-level(...), anomaly-level(...), voip-level(...), dlp-level(...), app-ctrl-level(...), waf-level(...), gtp-level(...), dns-level(...), ssh-level(...), ssl-level(...), cifs-level(...), file-filter-level(...), and icap-level(...).

Multiple values can be added for logid.

For example:

set filter "logid(<id>,<id>)"

set filter "event-level({emergency | alert | critical | error | warning | notice | information | debug})"

filter-type {include | exclude}

Include/exclude logs that match the filter.

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

To configure the syslogd filter with multiple values:

config log syslogd filter
    set filter "logid(0102043039,0102043040)"
end

To view the syslogd free-style filter results:

# execute log filter free-style "logid 0102043039 0102043040"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: logid 0102043039 0102043040
Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)
Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))

Configuring and debugging the free-style filter

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter set filter <string> set filter-type {include | exclude} end

filter <string>

Multiple values can be added for logid.

For example:

set filter "logid(<id>,<id>)"

set filter "event-level({emergency | alert | critical | error | warning | notice | information | debug})"

filter-type {include | exclude}

Include/exclude logs that match the filter.

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

To configure the syslogd filter with multiple values:

config log syslogd filter set filter "logid(0102043039,0102043040)" end

To view the syslogd free-style filter results:

# execute log filter free-style "logid 0102043039 0102043040" # execute log filter dump category: event device: disk start-line: 1 view-lines: 10 max-checklines: 0 HA member: log search mode: on-demand pre-fetch-pages: 2 Filter: logid 0102043039 0102043040 Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)" # execute log filter dump category: event device: disk start-line: 1 view-lines: 10 max-checklines: 0 HA member: log search mode: on-demand pre-fetch-pages: 2 Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205) Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))

Administration Guide

Configuring and debugging the free-style filter

Configuring and debugging the free-style filter

To configure the syslogd filter with multiple values:

To view the syslogd free-style filter results:

Configuring and debugging the free-style filter

To configure the syslogd filter with multiple values:

To view the syslogd free-style filter results: