_______________________________________________________________________________________________________
_______________________________________________________________________________________________________
© Virtual Access 2018
GW6600 Series User manual
Issue: 1.7
Page 84 of 519
op
Defines an optional severity condition.
(empty) match listed severity, and also anything more severe
!
match on less urgent severities than that listed
=
severity must match exactly
!=
match any severity other than than the listed severity
Examples:
*.debug matches all messages of debug severity and greater (ie. debug, info,
warning, etc.
*.=debug matches all debug messages.
pattern
Defines an optional pattern to match against the message text. The pattern is used to
restrict the number of log messages matching this filter.
The pattern syntax is a simple case-insensitive regular expression, using these
characters:
*
Matches zero or more characters.
?
Matches any single character (use this for spaces).
!
Matches anything not matching the following pattern.
^
Matches the start of a message.
$
Matches the end of a message.
Examples:
(firewall:)
Match any message containing the string 'firewall:'
(up*eth1)
Match any UP message referencing eth1
(!mobile)
Match only messages that don't include the string 'mobile'
(^mobile)
Match only messages beginning with the string 'mobile'
target
Defines what to do with the log message when a match occurs. It is optional for
remote filters. It can be the name of a disk file, or one of the special target keywords
listed below.
default
Do whatever the default action is, as if not filter rule matched.
ignore
Never log this message (useful for remote filtering).
console Log this message to the console. To view the console use
cat
/proc/conlog
For GW6600/GW6600V Series only.
mem
Log this message to the memory buffer (logread), if configured.
Note: logread is not stored through reboot.
~
Optional flag to indicate no further filters should be checked, if this filter matches. This
prevents later filters from acting on the same message. For convenience this is
automatically implied when a target of ignore is used. A space must be present before
the ~ character.
~
no further filters should be checked after a match.
(empty) continue checking other filters after a match.
Table 23: Filter syntax definitions
9.6.3
Filter examples
9.6.3.1
Example 1
Log all debug messages to memory buffer. Do not log anywhere else locally.
Log all authorisation facility messages to filepath ‘var/log/auth’. Do not log anywhere
else locally.
Log all ipsec messages to filepath ‘va/log/ipsec’. Do not log anywhere else locally.
For everything else, apply default local logging.
No remote filter rules defined, so apply default remote logging to all messages.
config syslog_filter 'local'
