IOS XR syslog message filter

[ElshanMammadli5597]

I want to configure logging on an IOS XR device so that:

• Syslog server (Graylog) receives all log messages

• Splunk server receives only user login and logout messages

I need to configure them separately so that the filters apply only to the Splunk server without affecting the logs sent to Graylog. Could you advise on the best way to achieve this on IOS XR?

Syslog config is below:

logging trap notifications
logging facility local7
logging 172.20.48.1 vrf default port 12301
logging source-interface Loopback0
logging hostnameprefix PE02

[MHM Cisco World]

logging host <A.B.C.D> discriminator <disc>

logging discriminator <disc> severity <severity-level>
logging discriminator <disc> msg-body include "TEXT"

MHM

[ElshanMammadli5597]

the command "logging discriminator' is not supported on IOS XR . it is supported by IOS XE

[MHM Cisco World]

logging ? <<- can I see option appear to you

MHM

[ElshanMammadli5597]

[MHM Cisco World]

sorry I dont have idea how you can solve this 
discriminator <<- is missing 
suppress will effect both server 

thanks 

MHM

[MHM Cisco World]

check this way if you can 
under logging host 
see if there is suppress 

MHM

[ElshanMammadli5597]

This config is like a solution, I tested is and it run

logging 172.22.48.30 vrf mgmt port default
logging 172.22.48.30 vrf mgmt discriminator
match2 SECURITY-SSHD-6

[Jens Albrecht]

Hello @ElshanMammadli5597,

on Cisco IOS XR you cannot directly filter or discriminate syslog messages per syslog server destination at the router itself.

So there are basically 2 options:

• Filter at the Syslog receiver.
  However, I have no experience with Splunk so that I don't know whether Splunk allows to filter incoming messages.
• Use a Syslog relay.
  You can deploy a syslog relay (such as Rsyslog, Syslog-ng, NXLog, or Logstash). The relay receives all logs from the IOS XR router and applies filters (based on message content, facility, etc.) and forwards only login/logout messages to Splunk, but all messages to Graylog.

HTH!

[ElshanMammadli5597]

This config is like a solution, I tested is and it run

logging 172.22.48.30 vrf mgmt port default
logging 172.22.48.30 vrf mgmt discriminator
match2 SECURITY-SSHD-6