我需要排除消息文件中的给定行:
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.4 DST=192.168.202.255 LEN=238 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32776 DPT=705 LEN=218
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.6 DST=192.168.202.255 LEN=183 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=700 LEN=163
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.8 DST=192.168.202.255 LEN=176 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32768 DPT=714 LEN=156
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.10 DST=192.168.202.255 LEN=175 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33628 DPT=715 LEN=155
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.30 DST=192.168.202.255 LEN=185 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32770 DPT=713 LEN=165
Oct 25 04:09:23 SERVERNAME PFILTER-DROP: IN=ifeth4 OUT= MAC=ff:ff:ff:ff:ff:ff:AA:AA:AA:AA:AA:AA:AA:AA SRC=192.168.202.34 DST=192.168.202.255 LEN=237 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32781 DPT=704 LEN=217
据我所知,它们是心跳 udp 消息,但日志中不需要它们。
# rpm -qa | grep -i syslog-ng
Security.syslog-ng-1.6.8.0-1
# uname -a
Linux SERVERNAME 2.6.5-7.325-bigsmp #1 SMP Tue Jan 18 23:36:49 UTC 2011 i686 i686 i386 GNU/Linux
# cat /etc/SuSE-release
SUSE LINUX Enterprise Server 9 (i586)
VERSION = 9
PATCHLEVEL = 4
问:如何从 /var/log/messages 中排除此类消息?
答案1
前:
SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf
#
#
log { source(src); destination(/var/log/messages); };
SERVER:/etc/syslog-ng #
编辑 syslog-ng.conf 文件:
vi /etc/syslog-ng/syslog-ng.conf
后:
SERVER:/etc/syslog-ng # tail -3 syslog-ng.conf
#log { source(src); destination(/var/log/messages); };
filter heartbeat_filter { not match("PFILTER-DROP") and not match("DST=192.168.202.255") and not match("PROTO=UDP"); };
log { source(src); filter(heartbeat_filter); destination(/var/log/messages); };
SERVER:/etc/syslog-ng #
重新启动系统日志-NG
/etc/init.d/syslog restart # or whatever you use to restart syslog-ng
# now check
如果需要的话可以旋转
logrotate /etc/logrotate.conf
答案2
您可以使用过滤器来匹配发送消息的程序,在本例中为 PFILTER-DROP,如下所示:
filter f_pfilterdrop {
program("PFILTER-DROP");
};
然后,将此过滤器包含在写入此日志的日志语句中。
答案3
如何扩展此排除规则以仅过滤包含以下内容的行:“DST=192.168.202.255”并使用“udp”和“PFILTER-DROP”?
使用类似的东西:
filter demo_filter { program("PFILTER-DROP") and match("DST=192.168.202.255") and match("PROTO=UDP"); };