# How to Filter SNMPtraps out of SYSlog-ng??!?

## AsianSpices

Hi 

i am collecting traps via a snmptrap daemon.

But i just noticed that syslog-ng is also collecting them in /var/log/messages

I would like to know how to filter them out into a separate file.

How do you do this?

i ahve tried useing

filter snmptrap { facility(local1); };

but that does nothing...

Any suggestions?

----------

## magic919

You have to have

Destination

Filter

Log

entries for this to work.  Something like:-

destination snmptrap { file("/var/log/snmptrap.log" perm(0644) ); };

filter f_snmptrap { facility(snmptrap); };

log { source(src); filter(f_snmptrap); destination(snmptrap); };

Tony

----------

## AsianSpices

 *Quote:*   

> 
> 
> root@K3 syslogs # /etc/init.d/syslog-ng restart
> 
>  * Stopping syslog-ng...                                                                                                               [ ok ]
> ...

 

it does not matter if i type snmptrap or snmptrapd either way it does not work  :Sad: 

currently i am using program("snmptrapd.*");

but it still double logs to /var/log/messages

 :Sad:   :Sad: 

----------

## magic919

Then you just need to correct the facility.  You could try filtering down from the messages filter if you find that easier.

----------

## AsianSpices

I am not quite sure what you mean...  :Sad: 

Can you be a bit more specific please/?

----------

## think4urs11

destination snmptrap { file("/var/log/snmptraps.log"); };

filter f_snmptrap { facility(*FACILITY snmptrapd uses*); };

log { source(src); filter(f_snmptrap); destination(snmptrap); };

*FACILITY snmptrapd uses* must be identical to the one configured in the snmptrapd (parameter -l 'lowercase L')

default values:

level -> LOG_WARNING

facility -> LOG_LOCAL0 

HTH

T.

----------

## AsianSpices

Huh?

i am confused now

 *Quote:*   

> 
> 
> ###########################################################################
> 
> #
> ...

 

what parameter in snmptrapd??

----------

## think4urs11

reference: http://net-snmp.sourceforge.net/docs/man/snmptrapd.html

----------

## AsianSpices

It stil double logs in Syslog-ng

But i used a filter to strip it into a next file...

But now i am trying to get all the msgs from the same network into the same file...

the regular expresings is not working for me  :Sad: 

----------

