Switching

Hello,

I'm trying to figure out why I can't stop a particular error message from filling up the logs on my syslog server. I've put a match in place already that should be stopping them, but for some reason the events keep showing on my syslog.

It's a known issue with the ex2300 apparently, and I get all kinds of the these mac_add and mac_delete events:

https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1352722

I have the following filter in place to remove these, and a few others:

set system syslog file messages match "!(ifd null)|(pfe_bcm_l2_mac_add)|(pfe_bcm_l2_mac_delete)|(.*loadDefaultService:: supported on tomcat only.*)"

Am I missing something ? 

Hi trink408,

 Try adding regex    .*   to match any character before or after your matches. You can include them all in a single parenthesis and separate them using pipe:

set system syslog file messages match "!(.*ifd null*.|.*pfe_bcm_l2_mac_add.*|.*pfe_bcm_l2_mac_delete.*|.*loadDefaultService:: supported on tomcat only.*)"

Regards!

Please mark as solved if it cleared your concern

Hi Trink, 

Greetings, 

From the link shared I understand that you want to filter the pfe_bcm_l2_mac_add and pfe_bcm_l2_mac_delete logs. We will have to modify the match condition as below:

set system syslog file messages match "!(.*ifd null.*|.*pfe_bcm_l2_mac_add.*|.*pfe_bcm_l2_mac_delete.*|.*loadDefaultService:: supported on tomcat only.*)"

Note: Any log entries that are prevented from being written to the log file will be lost and cannot be recovered.

Please mark "Accept as solution" if this answers your query.

Kudos are appreciated too!  

Regards,

Sharat Ainapur

Thanks for the tips.

I tried this method, but it still didn't stop the log events:

set system syslog file messages match "!(.*ifd null.*|.*pfe_bcm_l2_mac_add.*|.*pfe_bcm_l2_mac_delete.*|.*loadDefaultService:: supported on tomcat only.*)"

Is it worth restarting the syslog service or something to see if that helps? 

Below is my full syslog config, is part of the problem because I've called out syslog host any error, and then set syslog file messages any notice? 

set system syslog user * any emergency
set system syslog host xx.xxx.xx.xx.xxx any error
set system syslog file messages any notice
set system syslog file messages authorization info
set system syslog file messages match "!(.*ifd null.*|.*pfe_bcm_l2_mac_add.*|.*pfe_bcm_l2_mac_delete.*|.*loadDefaultService:: supported on tomcat only.*)"
set system syslog file interactive-commands interactive-commands any

How I was using the match was the problem, I needed to add the match string to the syslog host, I only had it added to the local syslog file.

This match fixed it:

set system syslog host xxxxxxxxxxxxx match "!(.*ifd null.*|.*pfe_bcm_l2_mac_add.*|.*pfe_bcm_l2_mac_delete.*|.*loadDefaultService:: supported on tomcat only.*)"

Thank you,