IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  SUSE - 11 logs not received

    Posted 02/08/21 02:03 AM
    Suse Linux 11 (OS) logs are not received on IBM QRadar 7.3.3 , an other OS with the same configurations is sending the logs to QRadar but this OS is unable to send the OS logs on QRadar .

    NOTE : On this particular OS (SAP) application is running but we only need the logs from OS .

    ------------------------------
    Ather Mobeen
    ------------------------------


  • 2.  RE: SUSE - 11 logs not received

    Posted 02/17/21 06:52 AM
    Ather,
    too may options for failing! Pls provide more details.
    • logs blocked by firewall?
    • on server? on QRadar? between those two?
    • qradar error logs checked in realtime?
    • if host OS is "unable to send logs" check host log 1st
    • compare config to the one that does work
    BR
    Karl

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: SUSE - 11 logs not received

    Posted 02/22/21 08:31 AM
    Hello Ather,

    maybe this will help you to make progress..
    https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/c_DSM_guide_Linux_OS_intro.html#c_dsm_guide_linux_os_intro

    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    IT Security Senior Consulting
    pro4bizz GmbH
    Karlsruhe
    +49 721 90981720
    ------------------------------



Related Content