Re: Talking to a syslog server

[Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx>]

You need the toolkit from IBM to get SIEM logging 


Jim Oberholtzer
Agile Technology Architects

> On Oct 16, 2024, at 12:02 PM, Rob Berendt <robertowenberendt@xxxxxxxxx> wrote:
>
> I just set up our FS7300 SAN to send data to QRadar siem.
> Took one command:
> mksyslogserver -name qradar01 -ip 10.10.4.192 -facility 7 -login on -audit
> on -warning on -info on -error on -protocol udp -port 514
> https://www.ibm.com/docs/en/flashsystem-7x00/8.6.x?topic=commands-mksyslogserver
> QRadar immediately got a log message that something was added.
> Tested an invalid, and a valid, signon and QRadar got those too.
>
> If only IBM i were that easy to configure communication to a syslog
> server...
>
> GO CMDSYSLOG
> Object CMDSYSLOG in library *LIBL not found.
>
> I do see the following if you want to blunder through this.  Granted this
> is only done periodically on demand and not as timely as the FS7300 version:
> https://www.ibm.com/docs/en/dsm?topic=i-configuring-integrate-qradar
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.