Re: iSeries Syslog support????

Konrad Underkofler wrote:

Is this code available anywhere? Seems like a real need to translate the System Message Queue and Audit Journals to a syslog format and forward them on to a server.

Konrad:

<vendor>
PowerTech (now a Help/Systems company) markets Interact -- a (near) real-time reporter of security related audit journal entries and QSYSMSG messages for syslog. (Also specifically to ISS's Site Protector.)
</vendor

Because the earlier reference was for a "commercial security software package", it'd be a little surprising to find the code freely available. From experience, I have to say that if the code is commercial quality, it'd _really_ be surprising.

Handling numerous audit journal entries in order to format them for syslog (and/or various syslog consoles) is far from a trivial task. And if the information is converted into any resemblance of a meaningful English statement, e.g., "The new *FILE MYLIB/MYFILE was restored to the system; the object was unsignable" and all the other potential sentences for different entry types, then I'd be amazed that anyone went through so much work for such a focused and limited market -- and then gave it away.

Just about anyone who's gone through that would want to be covered at least for the time spent on the phone with IBM -- which can be significant by itself.

Tom Liotta

gogo400 wrote ...

I actually wrote this exact thing some time ago for a commercial security
software package.

Anyone know of an opensource or free agent to convert the various AS400
security messages to a syslog format and forward them to a collector?