Logging

Match kernel messages with warning or higher priority

The following example shows a configuration that creates a filter that matches messages from the Linux facility kernel that have a priority of warning or higher. See Logging priorities for a list of logging priorities.

--{ + candidate shared default }--[  ]--
# info with-context system logging filter f1
    system {
        logging {
            filter f1 {
                facility kern {
                    priority {
                        match-above warning
                    }
                }
            }
        }
    }

Match informational or higher accounting messages

The following example creates a filter that matches messages from the Linux facility local6 (where SR Linux subsystem messages are logged by default) that have a priority of informational or higher and contain the text accounting. This filter can be used to match messages from the SR Linux accounting subsystem.

--{ + candidate shared default }--[  ]--
# info with-context system logging filter f2
    system {
        logging {
            filter f2 {
                contains accounting
                facility local6 {
                    priority {
                        match-above informational
                    }
                }
            }
        }
    }

Exclude informational or higher accounting messages

The following example creates a filter that excludes messages from the Linux facility local6 (where SR Linux subsystem messages are logged by default) that have a priority of informational or higher and contain the text accounting.

--{ + candidate shared default }--[  ]--
# info with-context system logging filter f3
    system {
        logging {
            filter f3 {
                not-contains accounting
                facility local6 {
                    priority {
                        match-above informational
                    }
                }
            }
        }
    }

Filter simple match

The following example creates the filter hostnameMatch that finds messages from facility local6 that contain hostname.

This configuration also creates the output buffer log, which uses the filter.

Messages that are matched must be from the source local6 and contain the word hostname.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
            filter hostnameMatch {
                contains hostname
                facility local6 {
                }
            }
            buffer log {
                filter [
                    hostnameMatch
                ]
            }
        }
    }

Filter dual sources

The following example creates the filter hostnameMatchDualFacility that finds messages from facility local6 and facility local5 that contain hostname.

This configuration also creates the output buffer log, which uses the filter.

Messages that are matched must be from the source (local6 or local5) and contain the word hostname.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
           filter hostnameMatchDualFacility {
                contains hostname
                facility local5 {
                }
                facility local6 {
                }
            }
            buffer log {
                filter [
                    hostnameMatchDualFacility
                ]
            }
        }
    }

Filter facility and subsystem

The following example creates the filter hostnameMatchFacilitySubsystem that finds messages from facility local6 and subsystem acl that contain the word hostname.

This configuration also creates the output buffer log, which uses the filter.

Messages that are matched must be from the source (local6 or acl) and contain the word hostname.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
           filter hostnameMatchFacilitySubsystem {
                contains hostname
                facility local6 {
                }
                subsystem acl {
                }
            }
            buffer log {
                filter [
                    hostnameMatchFacilitySubsystem
                ]
            }
        }
    }

Request dual filters

The following example creates the filter hostnameMatch that finds messages from facility local6 that contain the word hostname. This configuration also creates the filter userMatch that finds messages from facility auth that do not contain operator.

This configuration also creates the output buffer log, which uses both filters.

Messages that are matched must be from the source local6 and contain the word hostname or they must be from the source auth and not contain the word operator.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
            filter hostnameMatch {
                contains hostname
                facility local6 {
                }
            }
            filter userMatch {
                not-contains operator
                facility auth {
                }
            }
            buffer log {
                filter [
                    hostnameMatch
                    userMatch
                ]
            }
        }
    }

Request output filter and facility

The following example creates the filter hostnameMatch that finds messages from facility local6 that contain the word hostname.

This configuration also creates the output buffer log, which uses the filter and includes all messages from facility auth.

Messages that are matched must be from the source local6 and contain the word hostname or facility auth.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
            filter hostnameMatch {
                facility local6 {
                }
            }
            buffer log {
                filter [
                    hostnameMatch
                ]
                facility auth {
            }
        }
    }

Request output dual-filter and facility and subsystem

The following example creates the filter hostnameMatch that finds messages from facility local6 that contain the word hostname.

This configuration also creates the output buffer log, which uses the filter and includes all messages from facility auth and all messages from subsystem aaa.

Messages that are matched must be from the source local6 and contain the word hostname or facility auth or subsystem aaa.

--{ * candidate shared default }--[  ]--
# info with-context system logging
    system {
        logging {
            filter hostnameMatch {
                 contains hostname
                 facility local6 {
                }
            }
            buffer log {
                filter [
                    hostnameMatch
                ]
                facility auth {
                }
                subsystem aaa {
                }
            }
        }
    }