IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
Β View Only

  • 1.  syslog-ng & QRadar CE integration

    Posted 02/04/21 03:10 PM
    Hi, 

    I have a comprehensive syslog-ng environment which is collecting logs, I am now looking at sending these logs to CE for demonstration purposes, however I am unable to see any logs that I send from syslog-ng appear in CE, in addition I cannot see that CE is listening on IPv4 Port 514 or 601 (Standard syslog ports).

    If anyone has any idea or can guide me it would be greatly appreciated.

    Phil.

    ------------------------------
    Phil Freeman
    ------------------------------


  • 2.  RE: syslog-ng & QRadar CE integration

    Posted 02/05/21 04:49 AM
    Hi Phil,

    this sounds like your CE hits this issue: https://www.ibm.com/support/pages/node/6395080
    Please check this first. Just run this command as described in this support note..

    /opt/qradar/support/all_servers.sh -Ck 'if [ -f /opt/qradar/ecs/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/qradar/ecs/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ec-ingress/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ec-ingress/current/eventgnosis/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ep/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ep/current/eventgnosis/license.txt ; fi ; if [ -f /opt/ibm/si/services/ecs-ec/current/eventgnosis/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/ibm/si/services/ecs-ec/current/eventgnosis/license.txt ; fi ; if [ -f /usr/eventgnosis/ecs/license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /usr/eventgnosis/ecs/license.txt ; fi ; if [ -f /opt/qradar/conf/templates/ecs_license.txt ] ; then echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" > /opt/qradar/conf/templates/ecs_license.txt ; fi'
    Verify, if events are received after you've applied this command.

    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    IT Security Senior Consulting
    pro4bizz GmbH
    Karlsruhe
    +49 721 90981720
    ------------------------------



  • 3.  RE: syslog-ng & QRadar CE integration

    Posted 02/05/21 05:10 AM
    @Ralph Belfiore

    Thank you so much.  I can now see logs being received by QRadar CE πŸŽ‰

    Thanks again.

    Phil Freeman.​

    ------------------------------
    Phil Freeman
    ------------------------------

    Original Message


  • 4.  RE: syslog-ng & QRadar CE integration

    Posted 02/05/21 05:37 AM
    Your welcome :)
    good to know your CE is up and Running again.

    Regards,
    Ralph

    ------------------------------
    Ralph Belfiore
    IT Security Senior Consulting
    pro4bizz GmbH
    Karlsruhe
    +49 721 90981720
    ------------------------------

    Original Message


Related Content