Below is a simple applet which sends test syslog message and filtering tcl script. It works fine with message discriminator but does not work with logging filter.
event manager applet TEST
event none
action 1.0 syslog priority debugging msg "TEST message" facility "TEST-fac"
Router#more flash:Filter.tcl
set messages { {User:EEM} {Configured from \d+.\d+.\d+.\d+ by snmp} {Configured from console by EEScript} }
foreach m $messages {
if {[regexp -nocase $m $::orig_msg] > 0 } {
return ""
}
}
return "$::orig_msg"
Router#sh logg
Syslog logging: enabled (0 messages dropped, 8 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering enabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
Console logging: disabled
Monitor logging: level debugging, 3147 messages logged, xml disabled,
filtering enabled
Logging to: vty8(93)
Buffer logging: level informational, 3535 messages logged, xml disabled,
filtering enabled (3535 messages logged)
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: enabled
Persistent logging: disabled
Filter modules:
flash:Filter.tcl
Trap logging: level notifications, 181126 message lines logged
Logging to 10.x.z.y (udp port 514, audit disabled,
link up),
1019 message lines logged,
0 message lines rate-limited,
97032 message lines dropped-by-MD,
xml disabled, sequence number disabled
filtering enabled
Logging Source-Interface: VRF Name:
Loopback0
