How to turn off info logger from going to remote syslog server
I configured syslog-ng on the F5 LTM (10.2.1) to send system related log entries and iRule generated logs to a remote server. However, I do see many uneeded log entries that I want to avoid going to the log server - For example "info logger" type of entries - See example below. If you can help shed some light on how to avoid sending such log entries, and better customize syslog-ng to send in only system errors, it would be great -
-- On the F5 LTM, I see the following proccess running ( 2 of them)
logger -p local6.infologger -p local6.info
logger -p local6.infologger -p local6.info
-- Here are the log entries going to remote log server - "info logger" entries
Apr 16 10:07:59 slot1/ info logger: [ssl_req] [16/Apr/2012:10:07:59 -0700] x.y.z.w SSLv3 RC4-SHA "GET /xui/update/configuration/alert/statusmenu?_=1334595985972 HTTP/1.1" 960
Apr 16 13:06:14 70.151.46.84 Apr 16 10:07:44 slot1/ info logger: [ssl_acc] x.y.z.w - admin [16/Apr/2012:10:07:44 -0700] "GET /xui/update/configuration/alert/statusmenu?_=1334595970774 HTTP/1.1" 200 960
...
--- Here is a snippet of my my syslog-ng config for /var/log/ltm portion -
destination remote_server {
udp("x.y.z.w" port (514));
};
filter f_local0 {
facility(local0) and level(error);
};
filter f_no_audit {
not match("AUDIT");
};
destination d_ltm {
file("/var/log/ltm" create_dirs(yes));
};
log {
filter(f_local0);
filter(f_no_audit);
destination(d_ltm);
destination(remote_server);
};
Thanks -