Question about multiple filters in a User-ID Syslog Parser

[jsalmans]

Greetings all,

I noticed that the syslog parser for User-ID allows you to enter multiple filters for each server... does anyone know how adding multiple filters of the same type (login for example) will work?  I see there is a way to move the filters up and down in the list so I'd assume there is an order of operation but if it is able to match the regex in one does it stop or does it still proceed to the next filter?  If it goes through the entire list, I'm assuming it keeps whatever user-ID it was able to last grab?

Thanks!

[Remo]

Hi @jsalmans 

As there is the option to move the parsing profiles up and down, I am pretty sure that only the first one will match and if there is a match the profiles below in that list will not be checked - but it looks like this works to add multiple possibilities for login events.

Anothe rpossibility for parsing very different syslog messages is if you create your own regex whith which the firewall theoretically is able to combine multiple of the predefined strings into one. But the complexity of the regex string probably has - at least a small - impact on the mgmt cpu.