AIX

 View Only

  • 1.  AIX Syslog Forwading

    Posted Wed May 01, 2024 08:00 AM
    Edited by Pasindu Malintha Wed May 01, 2024 08:02 AM

    Hi Team,

    We are having a requirement to forward the log file in "/app/t24adm/T24/logs/tsa1/SystemOut.log" path to syslog server. Therefore can perform this task by adding the below entry to the /etc/syslog.conf file ? 

    "*"    /app/t24adm/T24/logs/tsa1/SystemOut.log    @<IP address of syslog server>

    AIX version - 7.2 TL5 U3

    Please advise.



    ------------------------------
    Pasindu Malintha
    ------------------------------



  • 2.  RE: AIX Syslog Forwading

    Posted Wed May 01, 2024 11:35 AM
    No... the syslogd service is awaiting messages sent to IT on port 514, not it going out and reading files.

    You can take the contents of that file and send it to syslog via the logger program

    So, when you say "to the syslog server". Where is the syslog server?  Local on the system? Or on a remote system?
    The format you have specified (@IPADDRESS) is used to send to a remote system's port 514

    The format to log locally can be found in the /etc/syslog.conf config file..
    The facility and priority are defined in column 1

    So in syslog.conf, you could set

    local0.*   /var/log/somefilenametosaveto        rotate size 1m files 4.  # whatever other options you want etc


    Then restart syslogd:
       ps -fu root | grep syslogd
       sudo kill -1 ####        #### is the pid of syslogd


    Then, in example below I use  local0.info. but use whatever facility/priority is appropriate.
     logger -p local0.info  -f /app/t24adm/T24/filenameblahblah


    Now, if this is a running log..  you'll get what's in the file as is, not what gets appended to it later.

    If you need the app to log to syslog, check the docs for a syslog option, looking for facility and priority. 
    If it doesn't support that, then you'll have to rotate your logs and use logger against the last file created
    OR....  Kludge it with a while loop using the message parm to the logger program.. 

    But, if you're logging it locally, why go through syslog?  Just make a copy of the logs
    If you're going to something like qradar, or some app that monitors your logs, then you'll need the @IP address option pointing to the qradar server..






    Original Message


  • 3.  RE: AIX Syslog Forwading

    Posted Wed May 01, 2024 12:32 PM

    Hi Tom,

    Thanks for the response. As you ask "to the syslog server" means, yes we are trying to send the logs to remote syslog server.

     As I explain in more details on our requirement, we are trying to send WebSphere log files that stored on the above mentioned path (/app/t24adm/T24/logs/tsa1/SystemOut.log) to remote syslog server. In there we want to know can we do the log forwarding using syslog ?

    And also can you please explain bit on your last point "Just make a copy of the logs If you're going to something like qradar, or some app that monitors your logs, then you'll need the @IP address option pointing to the qradar server.." because we want to do exactly the same thing. That means we need to forward the WebSphere logs to SIEM tool. 



    ------------------------------
    Pasindu Malintha
    ------------------------------

    Original Message


  • 4.  RE: AIX Syslog Forwading

    IBM Champion
    Posted Thu May 02, 2024 05:07 AM

    The syslog daemon does not read files.  If you want an application log to be sent to a remote syslog server, you'll have to configure the local syslog to forward the appropritae facility/level to the remote server, then use logger to forward it, however, logger doesn't tail the file, so you'll get the current messages and no more.



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------

    Original Message


  • 5.  RE: AIX Syslog Forwading

    Posted Thu May 02, 2024 05:05 AM

    Yes, you can forward the syslog to a remote syslog server.

    Use the information in these pages for how to configure this:

    https://www.ibm.com/docs/bg/dsm?topic=asdo-configuring-your-aix-server-device-send-syslog-events-qradar.

    https://community.graylog.org/t/how-to-put-the-syslog-from-aix-host-into-the-graylog-server/14293
    https://static.fortra.com/core-security/web-manuals-help/cts/current/gtthelp/content/resources/configuring_aix_syslog.htm



    ------------------------------
    Phill Rowbottom
    ------------------------------

    Original Message


  • 6.  RE: AIX Syslog Forwading

    IBM Champion
    Posted Thu May 02, 2024 08:11 AM

    If you want to send a log file to a remote syslog server there are several options:

    1. "Old school" way.

    Configure syslog to send logs to remote server something like:

    *.debug @my-syslog-server 

    Please not that in this case it will send ALL logs to the remote server. If you want to send only part of your logs, decide first which facility you want to use for it.

    Send content of the file using logger utility:

    logger -f /path/to/my/file

    If your file is not rotating, you should rotate it manually using some script. There are many ways to read only new data from a file but to explain it will be too much for a post in the forum.

    2. Most correct way

    Reconfigure your application to send logs directly to remote syslog server. Most of the application can do it today. Search in Google something like "your application name" + syslog and you will find an answer. Or open a case at your application's vendor and they show you the way.

    3. "Modern" way

    Install rsyslog on AIX. It can send files to remote log server.

    https://www.ibm.com/support/pages/ibm-aix-how-download-install-and-use-rsyslog-place-native-syslog-logging-service

    http://emmanuel.iffly.free.fr/doku.php?id=aix:aix_rsyslog



    ------------------------------
    Andrey Klyachkin

    https://www.power-devops.com
    ------------------------------

    Original Message