Re: Talking to a syslog server

[Evan Harris <auctionitis@xxxxxxxxx>]

I agree it should be simpler.
To be fair, the data and events from the IBM i are more complex than a SAN
is likely to be IMO.
There is a much stronger possibility that filtering or some other mechanism
might be required.
There are also a great many more different types of events to be sent
unless I am missing something.
The volume of events on the i compared to a SAN is much, much greater.
There are third party products that will do this, but arguably that adds
additional expense and complexity.
I've used the Razlee product, it has worked well and as advertised. Fortra
and Precisely also have offerings.

On Thu, Oct 17, 2024 at 6:02 AM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

> I just set up our FS7300 SAN to send data to QRadar siem.
> Took one command:
> mksyslogserver -name qradar01 -ip 10.10.4.192 -facility 7 -login on -audit
> on -warning on -info on -error on -protocol udp -port 514
>
> https://www.ibm.com/docs/en/flashsystem-7x00/8.6.x?topic=commands-mksyslogserver
> QRadar immediately got a log message that something was added.
> Tested an invalid, and a valid, signon and QRadar got those too.
>
> If only IBM i were that easy to configure communication to a syslog
> server...
>
> GO CMDSYSLOG
> Object CMDSYSLOG in library *LIBL not found.
>
> I do see the following if you want to blunder through this.  Granted this
> is only done periodically on demand and not as timely as the FS7300
> version:
> https://www.ibm.com/docs/en/dsm?topic=i-configuring-integrate-qradar
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.