sftpagent config - Exclude one file from wildcard directory

[JoeGumke]

I have a request where I need to filter a log file from a directory called exclude.log.

Note: that there are several other log files in this directory that end with *.log and *.log.1, and *.log.2

I just need to exclude the file exclude.log from the rsa sftpagent config stanza...how do I go about doing this?

dir0=S:\apache\logs

dir0.filespec=*.log

dir0.interval=300

dir0.compression=true

dir0.enabled=true

dir0.ftp=sender,upload,upload,publickey,//home/upload/eventsources/apache/systemname

[AkramHamed]

Hello,

If you want to exclude a string from regex, you can try "negative lookahead regex" , but you have to try it first and see if it works. this works with bash.

For more info about lookaround regex, please check the below link

Regex Tutorial - Lookahead and Lookbehind Zero-Length Assertions 

However, a simpler way to do that, is instead of using a very wide wild card like "*" try being more specific.

For example, instead of *.log* try something more specific like the below.

PATTERN1*.log*

PATTERN2*.log*

...

make sure to include all the patterns you wish to include.

Let me know.

Thanks,

Akram

[DavidWaugh1]

There is a undocumented feature (That should be documented!!) that allows you to exlcude words based on a text file:

dir0.removeemptylines

Set to true to strip extra line delimiters before they are passed to the collector. The default is false. Windows DNS records contain blank line spaces. Currently, the Log Collector does not strip these but rather, creates a new event with an empty header.

dir0.exclusionfile

Discards any records that contain a specified string (case sensitive). Some log files, such as the Microsoft DHCP log, can add a lot of unneeded records. Set the value to the name of the file that contains the string to exclude. Syntax: dir0.exclusionfile=filename where filename is a plain text file.

Save the file in the SA SFTP Agent installation directory. The file should contain a list of strings, one per line, to be excluded.

Caution: The exclusion file strings must not be ambiguous, and the final line of the file must be blank. Note: The parameters, removeemptylines and exclusionfile incur additional CPU overhead on the client side, thus we recommend that you use them only when needed. However neither incur any additional memory usage on the client.

Try creating a text file says c:\sasftpagent\ignore.txt

Fill up ingore.txt with lines / words that you are not interested in, then add

dir0=S:\apache\logs

dir0.filespec=*.log

dir0.interval=300

dir0.compression=true

dir0.enabled=true

dir0.ftp=sender,upload,upload,publickey,//home/upload/eventsources/apache/systemname

dir0.exclusionfile=ignore.txt

[JoeGumke]

thanks david!

I just tried this on a test box, and did not work. Its still sending the contents of the log files that I want excluded.

I added the exclusion command to my config below, and updated the ignore.txt file with a couple words that are contained in the log file that I do not want to send. I even tried the fullname of the log file in the exclusion file, and still didnt work.

Added to config:

dir0.exclusionfile=ignore.txt

The agent is definitely identifying the config, as its states this when starting up :

Loaded exclusion excludelog1
Loaded exclusion excludelog1.log
Loaded exclusion excludelog
3 exclusions loaded