1

I'm trying to omit a specific log from being sent to our NMS. We are already using a discriminator to limit the severity of messages to include 5,4,3,2,1,0. I'd also like to add to this so that it sends all syslogs including those 6 severities, but omits a specific log message. I've tried configuring like this so far, but I cannot get the particular message omitted.

Config:

logging discriminator WUG severity includes 5,4,3,2,1,0 msg-body drops rec'd IPSEC packet has invalid spi
logging discriminator CRYPTO msg-body drops "rec'd IPSEC packet has invalid spi"
logging buffered discriminator CRYPTO 16384 informational
logging source-interface Loopback0
logging host ipv6 2001:db8:38C6::1:200 discriminator WUG
logging host ipv6 2001:db8:5AC2::1:200

I will note that I have tried the mnemonics command and the msg-body command to no avail. I am still getting the crypto message sent to my NMS. Any ideas?

Improve this question
6
  • 2
    Did you actually apply the discriminator to your log settings? I’m asking because just creating the log discriminator is only one part.
    – Jesse P.
    Commented Mar 2, 2022 at 23:53
  • I did. I didn't do a great job showing the config, but the last line there shows it applied to my logging host
    – Ben
    Commented Mar 2, 2022 at 23:59
  • 1
    I edited your post to make it easier to read the logging config.
    – Jesse P.
    Commented Mar 3, 2022 at 0:23
  • 1
    Have you tried getting rid of the severity clause and only having msg-body to look for that string? I’ve never used mnemonics personally, only msg-body, and I know it works where I have it.
    – Jesse P.
    Commented Mar 3, 2022 at 0:31
  • 2
    If you only want severity events 5 and lower, why don’t you just have your logging host entry set to level 5 (via logging trap notification)? You can combine that with the message discriminator if necessary.
    – Jesse P.
    Commented Mar 3, 2022 at 1:09

1 Answer 1

Reset to default
1

I updated my config again in the original post with the working config. I must have done something wrong yesterday, but it is working today. I have two logging hosts. One is a dedicated syslog server that collects everything. The other is an NMS that we don't need to collect everything, so that's why I want to use the discriminator on it. The msg-body is to filter out a specific log that Cisco confirmed was a bug and shouldn't be being logged. For good measure, I created another discriminator to remove the crypto log from our buffered logging.

Improve this answer
1
  • I see. Good deal. Make sure to mark your answer so this doesn’t keep coming up as unresolved.
    – Jesse P.
    Commented Mar 3, 2022 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.