Ignoring Unwanted Messages

Question

Hello all,

I am evaluating the Kiwi Syslog Server Paid edition and we're receiving a repeated Warning message that we don't care about.

I would like to know if there's a way to drop this message from Kiwi upon arrival so that it doesn't get logged in file nor displayed on the Kiwi Syslog Web Portal.

My filter must be based on message text and not on host.

Thank you,

rschroeder · Accepted Answer

I can imagine a couple of ways you can do this.

*  Go to the device(s) sending the alarm and configure them to not sent that particular alarm to Kiwi.

*  Go to the device(s) sending the alarm and configure them to use a different syslog Facility number for that message.  Then filter it out by Facility in Kiwi.

*  If the above options don't fix it, set up a new Rule in Kiwi.  Go to Rules, right click on them and choose Add Rule.  Right click on the New Rule and give it an intuitive name.  Then right click below the new rule on Filter and choose Add Filter.  On the right side screen, select the Field drop-down and pick the Field you want to filter on.  If you know the message text you don't want to see, enter it here after choosing  Message Text in the top left drop-down, remembering to put the text inside double-quotes.  Make the Filter Type "Simple" in the top right drop-down.  Right-click on the filter name and give it an intuitive name.  Next go to the rule and right-click Action and Add a new Action.  Right-click on the Action and give it an intuitive name, too.  In the top right drop-down window, select what you want done to the message.  In this case you could choose Stop Processing Message.