IBM Security Verify

Expand all | Collapse all

Monitoring ISVA error in logs

  • 1.  Monitoring ISVA error in logs

    Posted Wed July 28, 2021 05:24 PM
    Hi all,

    I´d like to know if there is some way to monitor (with alerts) specific erros in ISVA logs that are linked with errors occurred during a web proxy request.  I´m sending some images attached.

    Regards,
    Rodrigo

    ------------------------------
    Rodrigo Xavier
    ------------------------------


  • 2.  RE: Monitoring ISVA error in logs

    Posted Thu July 29, 2021 05:27 AM
    Hi Rodrigo,

    There are several ways to achieve what you are looking for, I will only talk about the one we implemented.

    All our logs (webseal access logs + runtime logs + aac/federation logs) are sent into a centralised log management platform (Splunk for us).
    Once indexed properly, it is then very easy in the log management tool to create alerts based on specific conditions.

    Regards

    ------------------------------
    André Leruitte
    ------------------------------



  • 3.  RE: Monitoring ISVA error in logs

    Posted Thu July 29, 2021 08:35 AM
    Hi André,

    I went to sleep yesterday thinking about that...:-). This would be the best approach, I think.  But the customer doesn´t have an SIEM/syslog implemented.
    Could you talk more about the other ways that we can achive that?

    Thanks for your help!
    Regards,
    Rodrigo

    ------------------------------
    Rodrigo Xavier
    ------------------------------



  • 4.  RE: Monitoring ISVA error in logs

    Posted Thu July 29, 2021 10:57 AM
    Hi Rodrigo,

    I hope your night wasn't full of nightmares :)

    If even a solution based on a simple syslog server can't be deployed, I think you should be able to automate something by using ISAM REST api's.
    Those api's allow you to retrieve log files of the appliance. You could then run "grep" commands on those logs.

    You can check the "rapi" documentation for details on the REST apis.

    ------------------------------
    André Leruitte
    ------------------------------



  • 5.  RE: Monitoring ISVA error in logs

    Posted Thu July 29, 2021 11:25 AM
    Hi André,

    Has been an while that I´ve had nightmares....:(.
    Thanks for your help.  I´ll check the REST APIs documentation.

    Regards,
    Rodrigo



    ------------------------------
    Rodrigo Xavier
    ------------------------------