Wired Intelligent Edge

Hello,

I want to filter out the syslog messages for the hpe-restd

on Aruba-CX 6100 (PL.10.10.1040), I configured the filter for one syslog server, but the messages are not being sent to any of the configured syslog servers anymore:

logging filter no-Rest
    enable
     100 deny includes hpe-restd
     1000 permit

logging 172.16.0.38 include-auditable-events filter no-Rest
logging 172.16.2.193
logging 172.16.2.195
logging 172.19.2.11

But on the other side, on Aruba-CX 8325 (GL.10.09.1040) even when I apply the filter to every Syslog Server the hpe-restd events still are transmitted to the syslog servers.
I tried to change the regexp syntax, but without success:

logging filter no-Rest
    enable
     100 deny includes hpe-restd
     101 deny includes hpe\-restd
     102 deny includes hpe-restd*
     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Rest
logging 172.16.2.195 vrf MGMT-Switches filter no-Rest
logging 172.19.2.11 vrf MGMT-Switches filter no-Rest

Anyone any idea?

Thanks and kind regards

Robert

reply to push

push again

logging filter no-Rest
    enable
     100 deny includes hpe-restd
     101 deny includes hpe\-restd
     102 deny includes hpe-restd*
     103 deny includes (hpe-restd)
     104 deny includes .*hpe-restd.*
     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Rest
logging 172.16.2.195 vrf MGMT-Switches filter no-Rest
logging 172.19.2.11 vrf MGMT-Switches filter no-Rest

but syslog server still receives the syslog entries:

The filter works on the syslog message. The daemon (hpe-restd) is not part of that. You probably can filter on the event id. In my setup, I see all API calls being logged under event ID 4667 or 4668. You can filter those out:

logging filter event-noise
     10 deny event-id 4667-4668

There is a nice video on this feature.

logging filter no-Rest    enable     100 deny includes hpe-restd     101 deny includes hpe\-restd     102 deny includes hpe-restd*     103 deny includes (hpe-restd)     104 deny includes .*hpe-restd.*     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Restlogging 172.16.2.195 vrf MGMT-Switches filter no-Restlogging 172.19.2.11 vrf MGMT-Switches filter no-Rest

Hello Herman,

thanks for your response.

In my case there at least 4 event ids (others than yours):
2025-01-06T15:25:22.965182+01:00 vs-hvt-r04 hpe-restd[3959]: Event|4657|LOG_INFO|AMM|-|User xxxx logged out of REST session from x.x.x.x
2025-01-06T15:25:22.925436+01:00 vs-hvt-r04 hpe-restd[3959]: Event|4608|LOG_INFO|AMM|-|Authorization allowed for user xxxx, for resource SessionMgmt, with action POST
2025-01-06T15:25:07.999934+01:00 vs-hvt-r04 hpe-restd[3959]: Event|4655|LOG_INFO|AMM|-|User xxxxx logged in from 172.31.200.250 through REST session
2025-01-06T15:25:07.997869+01:00 vs-hvt-r04 hpe-restd[3959]: Event|4602|LOG_INFO|AMM|-|Authentication succeeded for user xxxx in session vBm8MfAtQcz2iGyrrdJhvw==

I would have preferred a one liner, but I will try.
And I hope its the same id on all of my cx switches (6000,6100,6200,8325,8360)...

Kind regards 

Robert

logging filter event-noise     10 deny event-id 4667-4668

logging filter no-Rest    enable     100 deny includes hpe-restd     101 deny includes hpe\-restd     102 deny includes hpe-restd*     103 deny includes (hpe-restd)     104 deny includes .*hpe-restd.*     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Restlogging 172.16.2.195 vrf MGMT-Switches filter no-Restlogging 172.19.2.11 vrf MGMT-Switches filter no-Rest

As shown in that video, you can use commas as well:

deny event-id 4602,4608,4655,4657,4667-4668

The event-id for a specific message is expected to be the same across all CX platforms.

logging filter event-noise     10 deny event-id 4667-4668

logging filter no-Rest    enable     100 deny includes hpe-restd     101 deny includes hpe\-restd     102 deny includes hpe-restd*     103 deny includes (hpe-restd)     104 deny includes .*hpe-restd.*     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Restlogging 172.16.2.195 vrf MGMT-Switches filter no-Restlogging 172.19.2.11 vrf MGMT-Switches filter no-Rest

Hi,

on Aruba-CX 6100 (PL.10.10.1040), I configured the filter for one syslog server, but the messages are not being sent to any of the configured syslog servers anymore:

logging filter no-Rest
    enable
     100 deny includes hpe-restd
     1000 permit

logging 172.16.0.38 include-auditable-events filter no-Rest
logging 172.16.2.193
logging 172.16.2.195
logging 172.19.2.11

Yes, per documentation of https://arubanetworking.hpe.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_5420/Content/Chp_RSyslog/RSyslog_cmds/logging%20filter.htm

And more specifically on the following:

'Filtering event logs on the switch: To permit or deny event logs from being generated on the switch. In this case, the matching event logs are filtered at generation. The denied event logs are neither logged to the switch events nor forwarded to any remote syslog servers. '

'If a filter contains enable command, it is not recommended to configure this filter in the logging command used for remote syslog server configuration. This is because, any event logs denied by the filter are already not available for forwarding to a remote server.'

As you have enabled a local logging filter AND have it enabled this means matchings will NOT be generated on the switch (Terminal Monitor will show them still) and hence will NOT make it to a Remote Syslog.

Trick here is to configure a logging filter but NOT enable it and then use the filter when configuring the Remote Syslog as you already did:

logging 172.16.0.38 include-auditable-events filter no-Rest

Note: Logging Filters are unlike ALC's in that there is an implicit allow at the end:
If no matching rule is found, the default action (permit) is applied.



 

logging filter no-Rest    enable     100 deny includes hpe-restd     101 deny includes hpe\-restd     102 deny includes hpe-restd*     103 deny includes (hpe-restd)     104 deny includes .*hpe-restd.*     1000 permit

logging 172.16.0.38 vrf MGMT-Switches filter no-Restlogging 172.16.2.195 vrf MGMT-Switches filter no-Restlogging 172.19.2.11 vrf MGMT-Switches filter no-Rest