Network devices can generate an overwhelming volume of syslog messages and SNMP traps - many of which are routine, repetitive, or simply not relevant to your monitoring needs. I'm excited to introduce Message Filtering, a powerful feature that lets you automatically drop unwanted messages before they're stored in the database.
Two Types of Filters
Backup Manager now provides separate filtering capabilities for both major message types:
- Syslog Message Filters: Filter out unwanted syslog messages from network devices
- SNMP Trap Filters: Filter out repetitive or unwanted SNMP trap notifications
Each filter type operates independently, giving you fine-grained control over what gets stored in your database.
Why Filter Messages?
In a busy network environment, you might receive millions of messages per day. Many of these are:
- Repetitive Authentication Failures: SNMP authentication failures from monitoring tools or scanners
- Routine Keepalives: Regular heartbeat or status messages that create noise
- Informational Messages: Low-priority debug or info messages you don't need to retain
- Port Security Violations: Repeated security violations on specific interfaces
- Storage Impact: Storing millions of unwanted messages consumes database space unnecessarily
How It Works
The filtering system sits at the intake point of both the syslog receiver and SNMP trap receiver. When a message arrives:
- The message is checked against all active filters for that message type
- If it matches any filter, the message is silently dropped
- Non-matching messages are stored normally in the database
- Filter hit counts track how many messages each filter has blocked
Flexible Matching Options
Create filters with different matching strategies to suit your needs:
- Contains (Recommended): Filter triggers if the message contains the filter string anywhere
- Exact Match: Message must exactly match the filter string
- Starts With: Filter triggers if the message begins with the filter string
- Ends With: Filter triggers if the message ends with the filter string
Easy Filter Management
Managing your filters is straightforward through the System Settings interface:
- Add Filters: Paste a problematic message or enter a pattern to filter
- Add Descriptions: Document why each filter exists for future reference
- Enable/Disable: Temporarily disable filters without deleting them
- Delete: Remove filters you no longer need
- Real-time Stats: See total filters, active filters, and messages filtered for each type
Pro Tip: Start by monitoring your syslog messages and SNMP traps for a few days to identify the most common "noise" messages. Then create targeted filters for patterns like %SNMP-3-AUTHFAIL, recurring port security violations, or routine trap notifications that don't require attention.
Example Use Cases
Here are some common filtering scenarios:
- SNMP Auth Failures: Filter
%SNMP-3-AUTHFAIL if you have legitimate tools triggering these
- Port Security Violations: Filter repeated security violations on specific interfaces like
Security violation on the interface GigabitEthernet6/0/10
- Scheduled Tasks: Filter messages from scheduled backup scripts or maintenance jobs
- Broadcast Messages: Filter specific facility messages you don't need to track
- Noisy Traps: Filter SNMP traps that fire too frequently to be useful
Getting Started
To access Message Filtering:
- Navigate to System → System Settings in the sidebar
- Scroll to the Syslog Message Filters or SNMP Trap Filters section
- Add your first filter by pasting a message or pattern in the text area
- Optionally add a description and select the match type
- Click Add Filter to activate it immediately
Filters take effect immediately - there's no need to restart any services. Start filtering out the noise today and focus on the messages that matter!