Documentation forKiwi Syslog Server

Filter messages based on host name

This feature is available only in the licensed edition of Kiwi Syslog Server NG.

Use the Host name filter to include or exclude messages in the filter based on the host name of the sending device. Only messages from the host you include trigger the actions in the associated rule.

If a rule does not contain a Host name filter, the Kiwi Syslog Server NG includes all hosts.

  1. From the Kiwi Syslog NG navigation bar, choose Setup > Rules.
  2. Locate an existing rule. If the rule does not exist, add a rule and start the New Rule wizard.
  3. If you are adding a filter to an existing rule, select the rule and click Edit. If you are creating a new rule, navigate to the Filters step of the New Rule wizard.
  4. Click Add filter. Define the filter name in the provided field.

  5. In the Field drop down, select Host name.

  6. Select an option from the Filter Type menu, and specify host names.

    7. Simple

    Enter host names to include in the filter. There is an OR operator between the host names. Messages from any of these hosts are included.

    For example, a message is included if the IP address of the sending device is 192.0.2.14 or 192.0.2.15.

    Check the Substring search box if you want the filter to include the IP address as a substring of another IP address. A substring search returns TRUE if the string is anywhere in the message.
    Complex

    Enter the host names to include or to exclude in the filter. There is an OR operator between host names on the same line. Messages are included or excluded if they are sent from any of the hosts on the line.

    For example, a message is excluded if the IP address of the sending device is 192.0.2.14 or 192.0.2.15.

    RegExp

    Enter regular expressions to specify the host names to include or exclude in the filter.

  7. If you are adding a filter to an existing rule, click Apply. If you are creating a filter in the New Rule wizard, click Add.