Syslog & SNMP Trap Filtering

Overview: Why Use Message Filtering?

Network devices generate thousands of syslog messages and SNMP traps every day. Many of these are routine, informational, or simply noise that clutters your logs and wastes storage space. Backup Manager's filtering feature allows you to automatically drop unwanted messages before they are stored.

Benefits of Filtering:

• Reduce Noise: Focus on critical events by eliminating routine messages
• Save Storage: Reduce database size by not storing unnecessary data
• Improve Performance: Faster searches and analysis with cleaner data
• Better Alerting: Avoid alert fatigue from repetitive, non-critical messages

Two Types of Filters:

• Syslog Message Filters: Drop unwanted syslog messages from network devices
• SNMP Trap Filters: Drop unwanted SNMP trap notifications

Both filter types work the same way - you define patterns that identify messages to discard. When a message matches a filter, it is silently dropped and never stored in the database.

Step 1: Navigate to System Settings

Both syslog and trap filters are configured in the System Settings page.

How to Get There:

• In the left sidebar, click on Settings to expand the menu
• Click on System Settings
• Scroll down to find the Syslog Message Filters and SNMP Trap Filters sections

What You'll See:

• Filter Input Area: Where you add new filter patterns
• Filter Statistics: Total filters, active filters, and messages filtered
• Active Filters List: All configured filters with enable/disable toggles

Step 2: Understanding Filter Match Types

When creating a filter, you can choose how the pattern should match against incoming messages. This gives you fine-grained control over what gets filtered.

Available Match Types:

• Contains (Recommended): Matches if the message contains the filter string anywhere. This is the most flexible and commonly used option.
• Exact Match: Matches only if the entire message exactly equals the filter string. Use this for very specific messages.
• Starts With: Matches if the message begins with the filter string. Useful for filtering by message prefix or facility.
• Ends With: Matches if the message ends with the filter string. Less commonly used but helpful for specific patterns.

Tip: Start with "Contains" match type - it's the most versatile and catches variations in message formatting.

Step 3: Add a Syslog Message Filter

Let's create a syslog filter to drop unwanted messages. Common candidates for filtering include SNMP authentication failures, routine keepalive messages, and informational link state changes.

To Add a Filter:

• Find the Syslog Message Filters section
• In the Add New Filter text area, paste or type the message pattern you want to filter
• Optionally add a Description to remember why you created this filter
• Select the Match Type (Contains is recommended)
• Click Add Filter

Example Syslog Filters:

• %SNMP-3-AUTHFAIL - SNMP authentication failures (often caused by scanners)
• %LINK-3-UPDOWN - Interface up/down messages (if you have many)
• %SYS-5-CONFIG_I - Configuration saved messages
• %CDP-4-NATIVE_VLAN_MISMATCH - CDP native VLAN warnings

Tip: Copy the exact message text from the Syslog dashboard and paste it into the filter field. You can then trim it down to the essential pattern.

Step 4: Add an SNMP Trap Filter

SNMP traps can also generate significant noise. Common culprits include authentication failure traps, link state traps from unused ports, and encrypted traps from devices without proper credentials configured.

To Add a Trap Filter:

• Scroll to the SNMP Trap Filters section
• In the Add New Trap Filter text area, enter the pattern to filter
• Optionally add a Description
• Select the Match Type
• Click Add Filter

Example Trap Filters:

• Encrypted (no credentials - Encrypted traps that can't be decoded
• authenticationFailure - SNMP authentication failure traps
• linkDown - Interface down traps (if excessive)
• coldStart - Device reboot traps (if expected)

What Gets Matched:

Trap filters are checked against the trap OID, trap type, and all variable bindings (varbinds) in the trap message. This means you can filter based on any part of the trap content.

Step 5: Managing Your Filters

After creating filters, you can manage them from the Active Filters list.

Enable/Disable Filters:

• Each filter has a checkbox toggle on the left
• Uncheck to disable a filter temporarily (messages will no longer be dropped)
• Check to re-enable the filter
• Disabled filters are shown with a grayed-out appearance

View Filter Statistics:

• Total Filters: Number of filters you've created
• Active: Number of currently enabled filters
• Messages/Traps Filtered: Total count of dropped messages
• Per-Filter Hits: Each filter shows its individual hit count

Delete Filters:

• Click the trash icon on the right side of any filter
• Confirm the deletion when prompted
• The filter is immediately removed and messages will no longer be dropped

Step 6: Monitor Filter Effectiveness

After creating filters, monitor their effectiveness to ensure they're working as expected.

Check Hit Counts:

• Each filter displays a "hits" counter showing how many messages it has dropped
• A high hit count indicates the filter is catching many messages
• A zero hit count after some time might mean the pattern doesn't match any messages

Review Filtered Totals:

• The "Messages Filtered" and "Traps Filtered" counters show overall effectiveness
• Compare this to your total message volume to see the reduction

Refresh the Filter List:

• Click the refresh button to update filter statistics
• Hit counts are updated in real-time as messages are filtered

Best Practices for Filtering

Start Conservative:

• Begin with a few specific filters for known noisy messages
• Monitor the Syslog and Trap dashboards to identify other candidates
• Add filters gradually as you identify patterns

Be Specific:

• Use specific patterns to avoid accidentally filtering important messages
• Include enough context in the pattern (e.g., include the facility code like %SNMP-3)
• Test filters by checking if legitimate messages still appear

Document Your Filters:

• Always add a description explaining why the filter exists
• This helps when reviewing filters later or when others need to understand them
• Include ticket numbers or incident references if applicable

Regular Review:

• Periodically review your filters to ensure they're still relevant
• Remove filters for devices or issues that no longer exist
• Check hit counts - filters with zero hits may no longer be needed

Don't Over-Filter:

• Avoid filtering too aggressively - you might miss important events
• Consider keeping informational messages for compliance or troubleshooting
• Use the Syslog Analysis page to understand message patterns before filtering

Common Filtering Scenarios

Scenario 1: SNMP Scanner Noise

If you see many SNMP authentication failure messages from unknown IP addresses (likely port scanners), add a filter for:

%SNMP-3-AUTHFAIL: Authentication failure

Scenario 2: Noisy Link State Changes

If certain ports (like end-user access ports) constantly generate up/down messages, filter them:

%LINK-3-UPDOWN: Interface GigabitEthernet0/

Scenario 3: Encrypted Traps

If devices send encrypted SNMP v3 traps that Backup Manager can't decode, filter the noise:

Encrypted (no credentials

Scenario 4: Routine Keepalives

Some devices send periodic keepalive or heartbeat messages that add no value:

%SYS-6-LOGGINGHOST_STARTSTOP