Re: Talking to a syslog server

Hi Patrik

maybe I phrased my response poorly. What I was trying to get at was that
the number, frequency and type of events on a SAN is much simpler and
smaller so you can probably just send the lot over and not think about it
too hard. I wasn't event thinking about message formatting or anything as
that is a comparatively trivial problem. I think it's reasonable to say
that the events being collected on a SAN is way more limited than a system
of record with multiple applications and thousands of users.

On the IBM i you have a myriad of possible sources, and much much larger
number of events to send over. You could theoretically just send them all,
but in my experience (admittedly limited) a certain amount were
filtered out as they were of no value and would just waste storage and
bandwidth..Even with filters on we got feedbak about "the deluge" of events
generated by the IBMi. FYI we have looked at various times at sending Audit
data, QHST records, journal changes for selected tables/columns and message
queues.

On Thu, Oct 17, 2024 at 12:10 PM Patrik Schindler <poc@xxxxxxxxxx> wrote:

Hello Evan,

Am 16.10.2024 um 20:31 schrieb Evan Harris <auctionitis@xxxxxxxxx>:

To be fair, the data and events from the IBM i are more complex than a

SAN is likely to be IMO.

This has nothing to do with SAN vs. IBM i, or complexity of events and
messages. It's just a different approach to essentially the same thing:
Generate a log about more or less relevant things happening on a given
system.

Syslog historically is a simple mechanism mostly found on UNIX like
systems to log arbitrary text sent from any application program either
locally to a text file, or to a remote server for further processing. The
syslog mechanism just adds a time stamp and optionally the program name,
and process ID. Syslog knows facilities and a severity level for easier
diversion of categories to separate log files. See
https://en.wikipedia.org/wiki/Syslog for further details.

IBM i logging uses central databases to hold predefined texts and
optionally can fill variables. There's more to it but I believe that this
is well-known in this group. Funnily, Windows NT and onwards uses a similar
approach with the Event Logger.

Having to only code the errmsgid and pass some relevant details is much
easier than to come up with consistent logging message appearance over many
points in the code where log messages are generated. This is an issue
especially in background applications with no interactive interface.

IBM has AFAIR just not yet managed to implement code to optionally send
(preparsed) QHST entries to a syslog server. Maybe this could be
implemented fairly easy with an exit program being called whenever a QHST
entry is added? Sending text within a UDP packet is not that hard. Adding
comfortable configuration screens is probably the majority of work.

:wq! PoC

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.