Configuring and debugging the free-style filter

Free-style filters allow users to define a filter for logs that are captured to each individual logging device type. Filters can include log categories and specific log fields. The filters can be created as an inclusive list or exclusive list.

Free-style filters can also be used to filter logs that have been captured on logging devices already to narrow down the list of logs to view.

config log syslogd filter
    set filter <string>
    set filter-type {include | exclude}
end

set filter "logid(<id>,<id>)"

set filter "event-level({emergency | alert | critical | error | warning | notice | information | debug})"

Use the following commands to view the results when multiple fields are used:

# execute log filter free-style "logid <id> <id>"

# execute log filter free-style "srcip <IP_address> <IP_address>"

# execute log filter free-style "(logid <id>) or (srcip <IP_address> <IP_address>)"

# execute log filter free-style "(srcip <IP_address>) and (dstip <IP_address>)"

In this example, the free-style filter is set to filter log IDs 0102043039 and 0102043040. The source IPs, 192.168.2.5 and 192.168.2.205, are also checked.

To configure the syslogd filter with multiple values:

config log syslogd filter
    set filter "logid(0102043039,0102043040)"
end

To view the syslogd free-style filter results:

# execute log filter free-style "logid 0102043039 0102043040"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: logid 0102043039 0102043040
Oftp search string: (and (or logid=="0102043039" not-exact logid=="0102043040" not-exact))

# execute log filter free-style "(logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)"
# execute log filter dump
category: event
device: disk
start-line: 1
view-lines: 10
max-checklines: 0
HA member:
log search mode: on-demand
pre-fetch-pages: 2
Filter: (logid 0102043039) or (srcip 192.168.2.5 192.168.2.205)
Oftp search string: (or (or (or srcip==192.168.2.5) (or srcip==192.168.2.205)) (or logid=="0102043039" not-exact))