Logging discriminator with multiple statements

[ekartsonak]

I am trying to set a logging discriminator that will drom any message contans the mnemonics etc. "ABC" and "XYZ". As fists step I configure this:

logging discriminator nolog mnemonics drops ABC

but when I am trying to add a second statement....

logging discriminator nolog mnemonics drops XYZ

...in the same discriminator (nolog) it replaces the first statement with the last. So in the show run I have always one statement for discriminator "nolog". Finally, how can I configure a logging discriminator with more than one statement?

I am using IOS Version 12.2(33)SRD4 on a Cisco 7609.

Thank you anyway,

[Ivan Krimmel]

Hi,

I never tried that, but it indeed looks like there's no way to have multiple statements in the same discriminator. But it's possible to configure multiple ones, why don't you go for that? I suppose there should be a reason, but anyway asking that ;)

Cheers,

Ivan.

[ekartsonak]

Hi Ivan,

I already tryed that so far. The problem is that when I am trying to add the second discriminator in "buffered" for example it replaces the first one. According to the documendation only one discriminator per destination can be applied. I read in a blog that we can have multiple statements per discriminator and that it is working like an ACL....but I can't make it work....

[ekartsonak]

it seems that the answer is the following format...

logging discriminator nolog mnemonics drops ABC|XYZ        ----> " | " =OR

this is nowhere documented....I found it after 2 days test

[Ivan Krimmel]

well, since 'drops' keyword expects a regex, it should work indeed.

[ekartsonak]

The problem that still exists is that if you want to create different  kind of statements in the same discriminator you just can not. For  example

logging discriminator nolog mnemonics drops ABC

logging discriminator nolog severity drops 1

.

.

any ideas? It smells like a bug 

[igorm1983]

You can add "sub-filters" one after the other!

logging discriminator LOGFILT facility drops AAA|DHCP msg-body drops "list"

facility is first sub-filter and msg-body is second one!

I have a problem with second sub-filter drops.

facility works fine and I don't see any messages containing AAA or DHCP but it seems that msg-body is not dropping messages that contain word "list" in the body of message.

[Jesse Peden]

Because the first "drop" wins - the rest are ignored.  Read the description of the feature on https://www.cisco.com/c/en/us/td/docs/ios/netmgmt/command/reference/nm_book/nm_09.html#wp1062700

It specifically states that "Subfilters are checked in the following order. If a message is dropped by any of the subfilters, the remaining checks are skipped."

[A D'Auria]

I was also having issues with the Logging Discriminator filters and finally figured out that the regex expression must NOT be enclosed in quotes.

Try:

logging discriminator LOGFILT facility drops AAA|DHCP msg-body drops list

"Show Logging" should then show under active (or inactive) discriminators:

LOGFILT   facility       drops    AAA|DHCP
          msg-body       drops    list

From what I can deduce from the CLI help is that the msg-body option takes the rest of the line as input whereas the other options take a single word/token. At least this is the case with a C3850 and IOS-XE 3.3.5.