Junos
Highlighted
Junos

syslog filtering with matching and exclusion criteria?

‎03-30-2016 03:50 AM

Does anyone know how to create a syslog configuration to show all the interface flappings (ifOperStatus) excluding one specific interface (ge-4/0/4)?

 

set system syslog file int-status match "(ifOperStatus)|!(ge-4/0/4)"

 

The configuration above does not work as it keeps showing the flappings for the ge-4/0/4) interface.

 

So, how can one configure it to exclude the ge-4/0/4 from the existing 'ifOperStatus' filter?

 

Thank you in advance

 

 

 

3 REPLIES 3
Highlighted
Junos

Re: syslog filtering with matching and exclusion criteria?

‎03-30-2016 05:34 AM

Hello ,

 

Check this : http://kb.juniper.net/InfoCenter/index?page=content&id=KB9382&actp=search

 

Eg : match "!(.*ge-4/0/4.*)"


Thanks,
Sam

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too .....
Highlighted
Junos

Re: syslog filtering with matching and exclusion criteria?

‎03-30-2016 07:12 AM

That is only for filtering on one text;  I wish to filter on two texts at the same time:

 

1.)  Show only all logged output with the following text in it:  ifOperStatus

2.) From all the filter output from 1) above, exclude any line that has the following text in it:  ge-4/0/4

 

I can't find anything on the web on how to combine two or more filtered items for one log file.

 

Thanks for your consideration.

Jacques

Highlighted
Junos

Re: syslog filtering with matching and exclusion criteria?

‎04-06-2016 01:29 AM

Hi Jaques,

 

I had a crack at this too and couldn't get a regex that works - it doesn't seem possible to combine cumulative matches into a single glob.

 

Although it's not specifically what you're after, you could use:

 

set interfaces ge-4/0/4 no-traps

to ensure that ge-4/0/4 never generates any log messages when it flaps, however this may not be ideal.

 

Hope this helps,

Ben Dale
JNCIP-ENT, JNCIP-SP, JNCIP-DC, JNCIE-SEC #63
Juniper Ambassador
Follow me @labelswitcher
Feedback