LogLogic IBM i5/os Collector Guide

Transcription

1 LogLogic IBM i5/os Collector Guide Software Release: 1.0 Document Release: December 2010 Part Number: LL EI This manual supports LogLogic IBM i5/os Collector Release 1.0 and later, and LogLogic Software Release 4.9 and later until replaced by a new edition.

2 2010 LogLogic, Inc. Proprietary Information Trademarks This document contains proprietary and confidential information of LogLogic, Inc. and its licensors. In accordance with the license, this document may not be copied, disclosed, modified, transmitted, or translated except as permitted in writing by LogLogic, Inc. LogLogic and the LogLogic logo are trademarks or registered trademarks of LogLogic, Inc. in the United States and/or foreign countries. All other company or product names are trademarks or registered trademarks of their respective owners. Notice The information contained in this document is subject to change at any time without notice. All warranties with respect to the software and accompanying documentation are set our exclusively in the Software License Agreement or in the Product Purchase Agreement that covers the documentation. LogLogic, Inc. 110 Rose Orchard Way, Suite 200, San Jose, CA Tel: Fax: U.S. Toll Free:

3 Contents Preface About This Guide Technical Support Conventions Chapter 1 Installing and Configuring the i5/os Collector Prerequisites Requirements Installing the i5/os Collector Copying the i5/os Collector Installation Files to the iseries Machine Running the i5/os Collector Installation Program Configuring the i5/os Collector Defining the i5/os Collector Remote Destination Configuring the QAUDJRN Collector Monitor Optional QAUDJRN Monitor Configuration Configuring the QHST Collector Monitor Creating a New Destination and Monitors Creating a New Destination for Log Data Creating New Monitors Configuring the LogLogic Appliance Starting and Stopping the i5/os Collector Processes Collector Command Summary Using the SRTSYSLOG Command to Start All Processes Using the ENDSYSLOG Command to Stop All Processes Starting and Stopping the Destination Processes Only Starting and Stopping the Monitor Processes Only Performance Tuning Options Upgrading the i5/os Collector Uninstalling the i5/os Collector Chapter 2 How LogLogic Supports i5/os i5/os Collector Components How the i5/os Collector Works Data Handler Transport Data Queue Transport Server Understanding Data Recovery Supported i5/os Data Types LogLogic Real-Time Reports LogLogic Summary Reports i5/os Collector Guide 3

4 Appendix A Audit Journal Entry Filters Adding Entries to the Audit Journal Entry Type Filter-Two Characters Adding Entries to the Audit Journal Entry Program Filter-Ten Characters Appendix B Audit Journal Entries Per Block Setting the Value for Audit Journal Entries per Block i5/os Collector Guide

5 Preface About This Guide Technical Support Conventions The LogLogic Appliance-based solution lets you capture and manage log data from all types of log sources in your enterprise. The LogLogic support for IBM i5/os enables LogLogic Appliances to capture logs from machines running IBM i5/os. Once the logs are captured and parsed, you can generate reports and create alerts on IBM i5/os s operations. For more information on creating reports and alerts, see the LogLogic Users Guide and LogLogic Online Help. LogLogic is committed to the success of our customers and to ensuring our products improve customers' ability to maintain secure, reliable networks. Although LogLogic products are easy to use and maintain, occasional assistance might be necessary. LogLogic provides timely and comprehensive customer support and technical assistance from highly knowledgeable, experienced engineers who can help you maximize the performance of your LogLogic Appliances. To reach LogLogic Customer Support: Telephone: Toll Free LOGS Local EMEA or APAC: + 44 (0) or +44 (0) support@loglogic.com You can also visit the LogLogic Support website at: When contacting Customer Support, be prepared to provide: Your name, address, phone number, and fax number Your company name and company address Your machine type and release version A description of the problem and the content of pertinent error messages (if any) LogLogic documentation uses the following conventions to highlight code and command-line elements: A monospace font is used for programming elements (such as code fragments, objects, methods, parameters, and HTML tags) and system elements (such as filenames, directories, paths, and URLs). A monospace bold font is used to distinguish system prompts or screen output from user responses, as in this example: username: system home directory: home\app A monospace italic font is used for placeholders, which are general names that you replace with names specific to your site, as in this example: LogLogic_home_directory\upgrade\ Straight brackets signal options in command-line syntax. For example: ls [-AabCcdFfgiLlmnopqRrstux1] [-X attr] [path...] i5/os Collector Guide 5

6 6 i5/os Collector Guide

7 Chapter 1 Installing and Configuring the i5/os Collector This chapter describes the installation and configuration of the LogLogic i5/os Collector and assumes that you have a functioning LogLogic Appliance to associate with the Collector. After completing the i5/os Collector installation you must configure the Collector before starting it. Note: The i5/os operating system runs on i5 and p5 hardware. The OS/400 operating system runs on iseries and AS/400 hardware. The i5/os Collector supports all of the above operating systems and hardware. In this document, all references using i5/os and iseries apply to all supported operating systems and hardware. Prerequisites Installing the i5/os Collector Configuring the i5/os Collector Creating a New Destination and Monitors Configuring the LogLogic Appliance Starting and Stopping the i5/os Collector Processes Performance Tuning Options Upgrading the i5/os Collector Uninstalling the i5/os Collector IMPORTANT! If you are upgrading to a newer version of the Collector, see Upgrading the i5/os Collector on page 30. In addition, check the LogLogic website for the latest release Rinformation. Prerequisites Prior to installing the i5/os Collector, ensure that you meet the following prerequisites: iseries or pseries system installed running the i5/os or OS/400 operating system V5R2M0 or later QSECOFR authority (root access) to install the Collector Ability to FTP the i5/os Collector installation files to the i5/os system Network connectivity to enable the i5/os Collector to send general syslog data to a specified LogLogic Appliance UDP port 514 opened for the destination LogLogic Appliance on any applicable firewalls or router access control lists (ACLs) Security settings allowing the restoration of programs that adopt authority, since the SYSLOG processes use programs that adopt authority Authority to access the library where the audit journal and audit journal receivers reside A TN5250 emulator to work with the i5/os operating system menus i5/os Collector Guide 7

8 Note: LPAR enables running multiple operating systems on one i5, p5, or iseries machine. If you are using Logical Partitioning (LPAR), the i5/os Collector requires that the SYSLOG application is installed on each i5/os partition that needs to be reported on. Each partition can report to the same LogLogic Appliance, or different LogLogic Appliance hosts as your reporting requirements dictate. The messages are sent on the default interface for a partition. A separate physical NIC is not required for each partition. Installing the i5/os Collector This section describes the installation of the i5/os Collector. After you have completed the installation process, you must configure the Collector before it starts capturing and forwarding log data to the associated LogLogic Appliance. IMPORTANT! By default the installation program enables auditing using the options available at V5R2 if auditing is not already enabled. If the journal QAUDJRN exists, the installation program does not modify any auditing system values. In addition the installation program grants QPGMR authority to the LSYSLOG user profile and objects in the LSYSLOG library to enable the daemons to be started in the system startup job. i5/os Collector Space Requirements As a starting point, the Application software requires 9 Mb. Allow up to 4 Gb for data queues (the data queue storage usually empies as fast as it s filled), plus some additional space for the debug log. In order to have logs to process, customers must activate security auditing which will produce the journal receiver data. The size is variable, based on how much is logged and how long journal receivers are kept (clean up is the user s responsibility). Copying the i5/os Collector Installation Files to the iseries Machine You must run the i5/os Collector installation program on the iseries machine where you want LogLogic to capture log data. The installation program is part of the lsyslogsav.savf save file that must be copied into the /qsys.lib/qgpl.lib directory. To maintain the integrity of the lsyslogsav.savf file, LogLogic recommends that you use FTP to transfer the file to the iseries machine. You can either use FTP from the destination iseries machine or use a workstation to remotely FTP the file to the destination iseries machine. The following steps provide an example of how to FTP the lsyslogsav.savf save file to the iseries machine. The following terminology is used: FTP Host FTP server hosting the lsyslogsav.savf save file. FTP Destination iseries machine where the i5/os Collector needs to be installed Note: The following steps provide an example of how to use the FTP put command to upload the Collector installation files to the FTP destination iseries machine in library /qsys.lib/qgpl.lib. If you do not need the FTP instructions, upload the lsyslogsav.savf save file and then proceed to Running the i5/os Collector Installation Program on page 9. 8 i5/os Collector Guide

9 To copy the lsyslogsav.savf file to the /qsys.lib/qgpl.lib library on the iseries machine: 1. Open a terminal window on the FTP Host machine, and then navigate to the directory where the lsyslogsav.savf file is located. 2. From the directory where the lsyslogsav.savf file is located, open an FTP session with the FTP destination machine (iseries machine). a. At the command prompt, type in the following command: FTP iseries machine iseries machine can either be the iseries host name or IP address. b. When prompted, enter the User name and Password. 3. At the command prompt, type in the following command to set the naming format to 1: quote site namefmt 1 The message Now using naming format "1" appears. 4. Ensure that you are in the /qsys.lib/qgpl.lib library. a. To navigate to the /qsys.lib/qgpl.lib library. b. Type the following command: cd /qsys.lib/qgpl.lib 5. At the command prompt, type in the following command to Set the representation type to binary image: binary The message Representation type is binary IMAGE appears. 6. Use the put command to copy the lsyslogsav.savf file from the FTP Host machine to the FTP Destination iseries machine in the /qsys.lib/qgpl.lib library. At the command prompt, type in the following command: put lsyslogsav.savf lsyslogsav.savf 7. After the FTP transfer is complete, type quit to close the terminal session. You can now run the i5/os Collector installation program. For more information, see Running the i5/os Collector Installation Program on page 9. Running the i5/os Collector Installation Program Once you have the lsyslogsav.savf file uploaded to your iseries machine, you can install the i5/os Collector. The installation program creates a default entry for the LogLogic Appliance named LOGLOGIC with the hostname as LogLogic. In addition, a QHST and QAUDJRN monitor are created for the LOGLOGIC destination. The following files are installed on your iseries machine: SFM0100 i5/os Collector system messages LYSLOGSF i5/os Collector build SLGINSTALL Installallation program for SYSLOG software SLGUPDATE Update program for SYSLOG software To run the i5/os Collector installation program: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. i5/os Collector Guide 9

10 Figure 1 Main Menu Screen 2. Restore the installation objects in the lsyslogsav.savf file to the QTEMP library. Type in the following command and then press the Enter key: RSTOBJ OBJ(*ALL) SAVLIB(lsyslogt) DEV(*SAVF) SAVF(QGPL/ LSYSLOGSAV) RSTLIB(QTEMP) The message 6 objects restored from LSYSLOGT to QTEMP appears. Note: QTEMP is a temporary location specific to each logged in user. Once the user logs out of the iseries machine, the QTEMP library is removed. 3. Type in the following installation command and then press the Enter key: QTEMP/SLGINSTALL The installation program creates a user profile LSYSLOG, restores the library LSYSLOG, and then creates an LSYSLOG home directory /home/lsyslog. The following message appears after a successful installation: Installation Completed Normally 4. Type in the following command and then press the Enter key to set the owner for /home/ lsyslog: CHGOWN OBJ( /home/lsyslog ) NEWOWN(LSYSLOG) The message Object changed. appears. The i5/os Collector is now installed on the iseries machine and is ready to be configured. To configure the Collector, see Configuring the i5/os Collector on page i5/os Collector Guide

11 Configuring the i5/os Collector You must configure the i5/os Collector before it can start operating. Configuring the Collector consists of defining the remote destination, monitoring details, and the destination of the LogLogic Appliance. Defining the i5/os Collector Remote Destination The i5/os Collector must be configured to send log data to the appropriate LogLogic Appliance. You can specify a single destination LogLogic Appliance or multiple Appliances. Note: LOGLOGIC is the predefined destination name. If you want to use a different name, then you must create a new destination with associated monitors. For more information, see Creating a New Destination and Monitors on page 20. To set the LogLogic destination and other destination options for the i5/os Collector: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. Figure 2 Main Menu Screen 2. From the command line, type in following command and then press the Enter key run the i5/os Collector configuration program: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. i5/os Collector Guide 11

12 Figure 3 Maintain Configuration Destination 3. Configure the i5/os Collector Destination. The destination is the LogLogic Appliance configured to handle the log data from the iseries machine. a. Move the cursor to the LOGLOGIC destination entry, type option 2 (change), and then press the Enter key. The Maintain Configuration Destination Change screen appears. Figure 4 Main Configuration Destination Change 12 i5/os Collector Guide

13 b. Configure the following information: Status Set to A (Active) to enable Host or IP Hostname or IP address of the destination LogLogic Appliance. The default Host is LogLogic. If you specify the hostname, then you must also add the hostname to the local host table so that the hostname is resolvable. For more information, see Step 5 on page 14. UDP Port Port number of the destination LogLogic Appliance. The default port number is 514. Dest CCSID The Destination Coded Character Set ID (CCSID) must be a valid target for the system CCSID (for example, 437 or 819). For more information, see the IBM product documentation. (Optional) Verbose Logging Set to Y to turn verbose logging on. For production environments, LogLogic recommends that you turn logging off (N). Figure 5 Maintain Configuration Destination Change Screen with Example Configuration 4. Press the Enter key once, and then press the Enter key again when prompted. The Maintain Configuration Destination screen appears showing any changes you made to the status (STS), Host (Host / IP Addr) and UDP Port. i5/os Collector Guide 13

14 Figure 6 Maintain Configuration Destination Screen with Status Changes 5. (Optional) If you are using a hostname instead of the IP address of the LogLogic Appliance capturing the log data, you must add the hostname to the local host table so that the value for the hostname is resolvable. a. From the Main Menu screen, at the command prompt, type in the following command: CFGTCP The CFGTCP screen appears. b. Select Option 10. c. Set the hostname. d. Test the configuration using ping to make sure the both name resolution and routing are working. You have now defined the destination appliance associated with the i5/os Collector. Before you can start the Collector, you need to configure the monitors to pick up log data from the iseries QAUDJRN and QHST logs. For more information, see Configuring the QAUDJRN Collector Monitor on page 14 and Configuring the QHST Collector Monitor on page 17. Configuring the QAUDJRN Collector Monitor Configuring the QUADJRN Collector Monitor consists of retrieving the attached Audit Journal file and defining the Audit Journal file and location in the file where the monitor starts capturing QAUDJRN log data. To configure the QUADJRN Collector Monitor: 1. Retrieve the attached receiver for QUADJRN. The attached receiver is the currently attached Audit Journal file used to capture Audit Journal entries on the iseries machine. a. Go to the Main Menu screen. Use the F3 key to exit from another screen. b. At the command prompt, type in the following command and the press the Enter key: WRKJRNA QAUDJRN The Work with Journal Attributes screen appears. 14 i5/os Collector Guide

15 Figure 7 Work with Journal Attributes Screen c. Copy or write down the Attached receiver name. In the screen above, the Attached receiver name is QAUDRCV002. You can view all receiver files by pressing the F15 key (or shift + F3). d. Press the F3 key to exit to the Main Menu screen. You may need to press the F3 key twice to return to the screen. 2. Define the attached receiver (i.e., Last Object) and starting point in the attached receiver log to start capturing log data (i.e., Last Entry). a. From the Main Menu screen, type in the following command and then press the Enter key: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. Figure 8 Main Configuration Destination Screen i5/os Collector Guide 15

16 b. Move the cursor to select the destination you want to configure, type option 12 (Maintain Monitors), and then press the Enter key. The Maintain Configuration Monitors screen appears displaying the QUADJRN and QHST objects (i.e., monitors). Figure 9 Maintain Configuration Monitors Screen c. Move the cursor to the QAUDJRN Type entry, type option 2 (change), and then press the Enter key. The Maintain Configuration Monitor Change screen appears. Figure 10 Maintain Configuration Monitor Change Screen d. Type in attached receiver name as the Last Object. This is the Attached receiver name you made a note of in Step 1c on page 15. e. Type in the value for the Last Entry. The Last Entry field controls the point at when the monitor starts to pick up log entries. Note: The monitor starts picking up the next entry after the specified Last Entry. For a new installation of the i5/os Collector, LogLogic recommends that you set the Last Entry to i5/os Collector Guide

17 Figure 11 Maintain Configuration Monitor Change Screen with Example Configuration f. Set the MonitorStatus to A (Active). 3. Press the Enter key once, and then press the Enter key again when prompted. The Maintain Configuration Monitors screen now lists the specified Last Object and Last Entry values. Optional QAUDJRN Monitor Configuration You can optionally filter audit journal entries by journal entry type and by journal entry program. Filtering by journal entry type will cause entries of that type to be omitted from processing regardless of the source. You can filter up to 250 journal entry types. Filtering by journal entry program will cause all journal entry types generated by the specified program to be omitted from processing. 'Omitted from processing' means that the journal entry will be retrieved but will not be reformatted and sent to your LogLogic appliance. You can filter up to 100 programs. The journal entry type filter and the journal entry program filter are not coupled. When an audit journal is retrieved, the type filter is checked. If the journal entry type is found, the journal entry is omitted. If the journal entry type is not found in the type filter, the program filter is checked. If the journal entry program is found, the journal entry is omitted. If the journal entry program is not found in the program filter, the journal entry is processed. For more information, see Appendix A Audit Journal Entry Filters on page 39. You can also configure the number of audit journals entries that are retrieved by the QAUDJRN Monitor within each block. This value controls the number of audit journal entries retrieved each time the monitor polls the QAUDJRN journal and pulls journal entries to be sent to the audit journal transformer jobs. The default value is 1,000 entries. The minimum value is 2 entries; the maximum is 5,000 entries. For more information, see Appendix B Audit Journal Entries Per Block on page 42. Configuring the QHST Collector Monitor Configuring the QHST Collector Monitor consists of retrieving the last or currently used log file and defining the location in the file where the monitor starts capturing QHST log data. i5/os Collector Guide 17

18 To configure the QHST Collector Monitor: 1. Retrieve last or currently used log file for QHST. a. Go to the Main Menu screen. Use the F3 key to exit from another screen. b. At the command line, type the following command and then press the Enter key: DSPOBJD QSYS/QHST* *File The Display Object Description - Basic screen appears. Figure 12 Display Object Description - Basic Screen c. Copy or write down the last file name in the list. You can verify that this is the last file by checking that it contains the latest Julian date in the Object column (e.g., QHST061753). Note: You might need to use the F18 (bottom) key to view the last file in the list. d. Press the F3 key to exit to the Main Menu screen. 2. Define the current QHST log file (i.e., Last Object) and starting point (i.e., Last Entry). a. From the Main Menu screen, type in the following command and then press the Enter key: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. 18 i5/os Collector Guide

19 Figure 13 Maintain Configuration Destination Screen b. Move the cursor to select the destination you want to configure, type option 12 (Maintain Monitors) and then press the Enter key. The Maintain Configuration Monitors screen appears displaying the QUADJRN and QHST Objects (i.e., monitors). Figure 14 Maintain Configuration Monitors Screen c. Move the cursor to the QHST Type, type option 2 (change), and then press the Enter key. d. Type in the value for the Last Object. The Last Object is the current QHST file. This is the Object name you made a note of in Step 1c on page 18. e. Specify the value for the Last Entry. The Last Entry field controls the point at which the monitor starts to pick up log entries. Note: The monitor starts picking up the next entry after the specified Last Entry. For a new installation of the i5/os Collector, LogLogic recommends that you set the Last Entry to 1. i5/os Collector Guide 19

20 Figure 15 Maintain Configuration Monitor Change Screen with Example Configuration f. Set the MonitorStatus to A (Active). 3. Press the Enter key once, and then press the Enter key again when prompted. The Maintain Configuration Monitors screen now lists the specified Last Object and Last Entry values. Figure 16 Maintain Configuration Monitors Screen Creating a New Destination and Monitors By default, the i5/os Collector installation program creates a destination named LOGLOGIC with QAUDJRN and QHST monitors. The following sections describe how to create a new destination and new or additional monitors. 20 i5/os Collector Guide

21 Creating a New Destination for Log Data If you require a new destination LogLogic Appliance to receive QHST and/or QAUDJRN log data, you must create a new destination with a valid IP address, UDP port, and Destination CCSID. The destination is the LogLogic Appliance configured to handle the log data from the iseries machine. To define a new destination for QHST and/or QAUDJRN log data: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. 2. From the command line, type in the following command and then press the Enter key: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. Figure 17 Maintain Configuration Destination Screen 3. Press the F6 key (Add New Destination) and then press the Enter key. The Maintain Configuration Destination Create screen appears. i5/os Collector Guide 21

22 Figure 18 Maintain Configuration Destination Create Screen 4. Enter the following information: Destination The LogLogic Appliance name (for example, LOGLOGIC). The destination must be a unique name and can be up to 9 characters long. Status Set to A (Active) to enable Host or IP Hostname or IP address of the destination LogLogic Appliance. If you specify the hostname, then you must also add the hostname to the local host table so that the hostname is resolvable. For more information, see Step 5 on page 14. UDP Port Port number of the destination LogLogic Appliance. The default port number is 514. Dest CCSID The Destination CCSID must be a valid target for the system CCSID (for example, 437 or 819). For more information, see the IBM product documentation. (Optional) Verbose Logging Set to Y to turn verbose logging on. For production environments, LogLogic recommends that you turn logging off (N). Figure 19 Maintain Configuration Destination Create Screen with Example Configuration 22 i5/os Collector Guide

23 5. Press the Enter key to apply your changes. The Maintain Configuration Destination Create screen appears with your input and a message stating Press ENTER to accept. 6. Press the Enter key to accept the inputs. The Maintain Configuration Destination screen appears. 7. Verify that your new destination is in the list. Figure 20 Maintain Configuration Destination Screen with New Destination Entry LOGLOGIC2. Creating New Monitors If you need to new or additional monitors to capture QHST and/or QAUDJRN log data, you can manually create them using the steps below. To define a new monitor for QHST and/or QAUDJRN log data: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. 2. From the command line, type in the following command and then press the Enter key: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. i5/os Collector Guide 23

24 Figure 21 Maintain Configuration Destination Screen 3. Move the cursor to select the destination you want to configure, type option 12 (Maintain Monitors), and then press the Enter key. The Maintain Configuration Monitors screen appears. Figure 22 Maintain Configuration Monitors Screen 4. Press the F6 key (Add New Monitor). The Maintain Configuration Monitors Create screen appears. 24 i5/os Collector Guide

25 Figure 23 Maintain Configuration Monitors Create Screen 5. Enter the following information: MonitorType The type of monitor. Currently the i5/os Collector only supports QAUDJRN and QHST monitor logs. MonitorStatus Set to A (Active) Object Set the object and associated library (e.g., QAUDJRN or QHST) Last Object Specify the attached receiver (for the QUADJRN monitor) and/or the last attached file (for the QHST monitor). For more information, see Configuring the QAUDJRN Collector Monitor on page 14 and/or Configuring the QHST Collector Monitor on page 17. Last Entry Set the last entry value to control the point when the monitor starts to pick up log entries. The monitor starts picking up the next entry after the specified Last Entry. Figure 24 Maintain Configuration Monitors Create Screen with Example Configuration 6. Press the Enter key once, and then press the Enter key again when prompted. The Maintain Configuration Monitors screen appears showing the new monitor. i5/os Collector Guide 25

26 Figure 25 Maintain Configuration Monitors Screen with New Monitor Listed 7. Repeat Step 4 on page 24 through Step 6 on page 25 for each additional monitor. Configuring the LogLogic Appliance You must add the i5/os machine to the LogLogic Appliance as a new device in order to support logs coming from the i5/os Collector. For more information on adding support for devices to the LogLogic Appliance, see the LogLogic Administration Guide. LogLogic recommends that you set the destination LogLogic Appliance to auto-discover new devices. Once the i5/os Collector starts sending general syslog messages, the LogLogic Appliance will automatically discover the iseries machine and begin to capture log data. After you have configured the LogLogic Appliance to support the iseries machine, you can start the i5/os Collector. For more information, see Starting and Stopping the i5/os Collector Processes on page 26. Note: On an LX or MX Appliance, you can use the Real-Time Viewer to verify that you are receiving messages from the Collector. Starting and Stopping the i5/os Collector Processes The following sections identify how to start and stop the Collector processes. For data to be collected from the i5/os logs (i.e., QHST and QAUDRJN), transformed, and sent to the LogLogic Appliance, the destination and corresponding monitors must all be active. You can start and stop the Collector processes with a single command or stop and start each individual component (i.e., destination and monitors). IMPORTANT! Before starting the i5/os Collector processes, make sure you have already configured the LogLogic Appliance to receive general syslog messages from the iseries machine. For more information, see Configuring the LogLogic Appliance on page 26. Collector Command Summary The i5/os Collector uses the following commands: 26 i5/os Collector Guide

27 STRSYSLOG/ENDSYSLOG Starts/ends specified destination and all corresponding monitors. For more information, see Using the SRTSYSLOG Command to Start All Processes on page 27 and Using the ENDSYSLOG Command to Stop All Processes on page 27. WRKSLGCFG Provides a list of destinations; for selected destination, provides a list of all monitors. Functions provided in each list are: change, delete, display, start, end. For more information, see Starting and Stopping the Destination Processes Only on page 27 and Starting and Stopping the Monitor Processes Only on page 28. STRSLGSVR/ENDSLGSVR Starts/ends individual destination only STRSLGAUD/ENDSLGAUD Starts/ends AUDJRN monitor (and associated transformers) for specified destination only STRSLGHST/ENDSLGHST Starts/ends QHST monitor for specified destination only Using the SRTSYSLOG Command to Start All Processes LogLogic recommends that you add the STRSYSLOG command to the program defined in the QSTRUPPGM system value so that the daemons start along with the rest of the normal system jobs. The STRSYSLOG command reads the control files, submitting one job for each object to be reported through SYSLOG, and one job to send the messages to the LogLogic Appliance. Jobs are submitted to the QSYSNOMAX job queue, which is generally serviced by QSYSWRK subsystem. Jobs are named <Destination>T, <Destination>H, <Destination>J, and <Destination>JJ (where <Destination> is the name of the LogLogic Appliance, e.g., LOGLOGIC), for the transmitting daemon, history processor, audit journal processor, and audit journal transformer jobs respectively. To start all of the i5/os Collector processes, run the STRSYSLOG program by typing the following command at the prompt: LSYSLOG/STRSYSLOG LSYSLOG Note: The STRSYSLOG program must be started after TCP is running. If TCP is stopped, the SYSLOG daemon stops. If you manually restart the SYSLOG process, TCP must be restarted first. Using the ENDSYSLOG Command to Stop All Processes Running the ENDSYSLOG command ends all processes started by the STRSYSLOG command. You may also end individual processes with their corresponding commands, by using the ENDJOB command after at least 15 seconds with a controlled end. To end all of the i5/os Collector processes, run the ENDSYSLOG program by typing the following command and then pressing the Enter key LSYSLOG/ENDSYSLOG LSYSLOG Starting and Stopping the Destination Processes Only If you need to start or stop the Destination (i.e., LOGLOGIC) processes, complete the following steps: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. i5/os Collector Guide 27

28 2. From the Main Menu command prompt, type in the following command: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. 3. Select the destination you want to start or stop and type in the appropriate value. Type 9 (Start Destination) to start the process Type 10 (End Destination) to stop the process 4. Press the Enter key. Starting and Stopping the Monitor Processes Only If you need to start or stop the Monitor processes, complete the following steps: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. 2. From the Main Menu command prompt, type in the following command: LSYSLOG/WRKSLGCFG The Maintain Configuration Destination screen appears. 3. Select the destination with the monitors you want to start or stop. 4. Type option 12 (Maintain Monitors) and then press the Enter key. The Maintain Configuration Monitors screen appears. 5. Select the monitor you want to start or stop and type in the appropriate value. Type 9 (Start Destination) to start the process Type 10 (End Destination) to stop the process 6. Press the Enter key. 28 i5/os Collector Guide

29 Performance Tuning Options Performance tuning options are available that allow you to control the execution priority and time slice used for transmitting daemon jobs, monitor jobs (i.e., history processor jobs and audit journal processor jobs), and audit journal transformer jobs. To change execution priority and/or time slice values for these batch jobs, use the CHGCLS command. Note: You must have a sufficient level of authority to run the CHGCLS command. The default values are shown in the following examples: Example 1 Change Values for Transmitting Daemon Jobs (<Destination>T) Change Class (CHGCLS) Type choices, press Enter. Class CLS > SLGCLSDST Library > LSYSLOG Run priority RUNPTY 50 Time slice TIMESLICE 2000 Example 2 Change Values for QHST and QAUDJRN Monitor Jobs (<Destination>H and <Destination>J) Change Class (CHGCLS) Type choices, press Enter. Class CLS > SLGCLSMON Library > LSYSLOG Run priority RUNPTY 50 Time slice TIMESLICE 2000 Example 3 Change Values for Audit Journal Transformer Jobs (<Destination>JJ) Change Class (CHGCLS) Type choices, press Enter. Class CLS > SLGCLSXF Library > LSYSLOG Run priority RUNPTY 50 Time slice TIMESLICE 2000 Note: For more information on the job naming convention (<Destination>H, <Destination>J, etc.), see Using the SRTSYSLOG Command to Start All Processes on page 27. Note: Object auditing should not be used on Collector software objects (or if it is, only 1 or 2 critical objects should be selected for auditing). IBM recommendations for object auditing caution that object audit parameters should be carefully planned; else performance impact is highly likely. i5/os Collector Guide 29

30 Upgrading the i5/os Collector This section describes how to update the i5/os Collector daemons. To upgrade the i5/os Collector: 1. Log in to the iseries machine with QSECOFR equivalent authority. The Main Menu screen appears. 2. From a command prompt, type in the following command and then press the Enter key: LSYSLOG/ENDSYSLOG LSYSLOG This will end all of the i5/os Collector processes. You may need to wait a few minutes for all of the processes to end. 3. Use FTP to transfer the new i5/os Collector lsyslogsav.savf file to the iseries machine. For more information, see Copying the i5/os Collector Installation Files to the iseries Machine on page Type in the following command and then press the Enter key: RSTOBJ OBJ(*ALL) SAVLIB(lsyslogt) DEV(*SAVF) SAVF(QGPL/LSYSLOGSAV) RSTLIB(QTEMP) The message 6 objects restored from LSYSLOGT to QTEMP appears. This command restores the installation objects in the lsyslogsav.savf file to the QTEMP library. Note: QTEMP is a temporary location specific to each logged in user. Once the user logs out of the iseries machine, the QTEMP library is removed. 5. Type in the following command and then press the Enter key: QTEMP/SLGUPDATE The SLGUPDATE program updates the programs and other objects in LSYSLOG while retaining the settings and last retrieval settings for the objects reported through the SYSLOG client. 6. (Optional) Reset the Last Entry to the appropriate value to ensure that you have not missed any log files. Check the LogLogic Appliance for the last entry that was captured and then specify the value in the Last Entry field to that value. For more information on setting the QAUDJRN and QHST last entries, see Configuring the QAUDJRN Collector Monitor on page 14 and Configuring the QHST Collector Monitor on page 17 respectively. 7. From a command prompt, type in the following command and then press the Enter key: LSYSLOG/STRSYSLOG LSYSLOG This will start all of the i5/os Collector processes. You may need to wait a few minutes for all of the processes to start. 30 i5/os Collector Guide

31 Uninstalling the i5/os Collector Before uninstalling the i5/os Collector, make sure you are able to execute commands requiring QSECOFR authority (i.e., root access). To uninstall the i5/os Collector: 1. Log in to the iseries machines running the i5/os Collector with QSECOFR authority. The Main Menu screen appears. 2. From the command line, type in the following command and then press the Enter key: LSYSLOG/ENDSYSLOG DEST(*ALL) Verify that all i5/os Collector jobs have ended. The jobs might take a few minutes to end. 3. From the command line, type in the following command and then press the Enter key: DLTLIB LIB(LSYSLOG) This will delete all of the destination files. 4. From the command line, type in the following command and then press the Enter key: DLTUSRPRF USRPRF(LSYSLOG) OWNOBJOPT(*DLT) This will delete the i5/os Collector LSYSLOG profile and all other Collector objects on the system including the debug log files and paths. To uninstall the i5/os Collector (Release 1.1.x Only): IMPORTANT! Perform this procedure only if you want to uninstall Collector release 1.1.x. 1. Complete all the steps outlined in To uninstall the i5/os Collector: on page From the command line, type in the following command and then press the Enter key: wrklnk '/home/lsyslog/*' 3. Select option 4 to delete the log files. 4. From the command line, type in the following command and then press the Enter key: rmvdir '/home/lsyslog' Note: This command will fail if there are files in the directory. 5. From the command line, type in the following command and then press the Enter key: DSPSBSD QSYSWRK 6. Select option 7 to display the routing entries and then scroll down until you see Sequence Number Verify that compare values start with LSYSLOG, then press F3 to go back to the command line. 8. From the command line, type in the following commands and press the Enter key: RMVRTGE SBSD(QSYSWRK) SEQNBR(8881) RMVRTGE SBSD(QSYSWRK) SEQNBR(8882) RMVRTGE SBSD(QSYSWRK) SEQNBR(8883) i5/os Collector Guide 31

32 Chapter 2 How LogLogic Supports i5/os The LogLogic i5/os Collector enables the LogLogic Appliances to capture history logs and audit journals from machines running the i5/os operating system such as IBM s iseries. Note: The i5/os operating system runs on i5 and p5 hardware. The OS/400 operating system runs on iseries and AS/400 hardware. The Collector supports all of the above operating systems and hardware. In this document, all references using i5/os and iseries apply to all supported operating systems and hardware. i5/os Collector Components How the i5/os Collector Works Understanding Data Recovery Supported i5/os Data Types LogLogic Real-Time Reports LogLogic Summary Reports i5/os Collector Components The IBM i5/os operating system contains various files, databases, and journals (logs) that do not have a native ability to be transferred to remote systems. In addition, the structure of the logs and the character sets make access to the log information potentially difficult. The i5/os Collector enables the transfer of log entries to a remote LogLogic Appliance by: Monitoring and extracting log entries from specific i5/os logs Converting binary (EBCDIC) log data to ASCII-based log data to be captured by LogLogic Appliances Forwarding converted log data to LogLogic Appliances using UDP 32 i5/os Collector Guide

33 Figure 26 LogLogic Collector Architecture for IBM i5/os QHST Data Handler QHST Monitor QHST Formatter QAUDJRN Data Handler QAUDJRN Monitor QAUDJRN Extractor QAUDJRN Transport Data Queue QAUDJRN Formatter 1 QAUDJRN Formatter 2 QAUDJRN Formatter nn Transport Data Queue Transport Server Data Converter Data Transporter The i5/os Collector consists of the following components: Data Handler - Captures binary log data from the i5/os QHST and QAUDJRN logs and then maps and reformats message data so it can be converted to ASCII text. For more information, see Data Handler on page 34. QAUDJRN Transport Data Queue - Holds raw audit journal entry data to be mapped and reformatted by QAUDJRN formatters (i.e., transformers). For more information, see Transport Data Queue on page 35. Transport Data Queue - Holds reformatted log data to be forwarded to LogLogic Appliances by the Transport Server. For more information, see Transport Data Queue on page 35. Transport Server - Converts log data in binary (EBCIDIC) format to ASCII format, and then sends the log data to the specified LogLogic Appliance using UDP. For more information, see Transport Server on page 35. How the i5/os Collector Works All of the functionality of the LogLogic Collector for IBM i5/os occurs on the iseries machine running the i5/os operating system. Jobs running in the i5/os operating system perform functions that generate history (QHST) and audit journal (QAUDJRN) log entries. Note: The Collector supports all audit formats from V5R2 through V5R4 and supports all QHST formats. Figure 27 on page 34 illustrates a high-level overview of how i5/os data from jobs is passed through the i5/os Collector to the LogLogic Appliance. i5/os Collector Guide 33

34 Figure 27 i5/os Collector Forwarding Captured Log Data to a LogLogic Appliance i5/os Components LogLogic Collector Components i5/os Jobs QHST Log Polling QHST Data QAUDJRN Log Polling QAUDJRN Data Data Queue Transport Server UDP LogLogic Appliance Data Queue QAUDJRN Transformer1 QAUDJRN Transformer2 QAUDJRN Transformer3 QAUDJRN Transformern Data Handler The i5/os Collector has two data handlers that manage the bulk of the log data processing, the QHST Data Handler and the QAUDJRN Data Handler. The data handlers perform the following functions: Poll the QHST log and QAUDJRN log for new log entries Read the QHST file and receive entries from the QUADJRN system audit journal Maintain a record of the last log entry that was processed from each of the i5/os logs Format the log data by adding delimiters, mapping data fields, adding keywords and control information Forward the formatted log data to the Data Queue to be sent to the associated LogLogic Appliance Note: LogLogic data formatters do not modify or remove log data stored in the QHST and QAUDJRN logs. Polling The data handlers have data monitors that poll the QHST and QAUDJRN logs as entries are added. Polling is single-threaded and continues so long as new entries are available to retrieve. However, if no new log entries exist, by default the polling mechanism waits up to 15 seconds before polling again. The QHST and QAUDJRN logs contain a running record of log entries where each new entry is added to the existing records. The data monitors maintain a record of which entries were retrieved during the last poll cycle and therefore no duplicate entries are forwarded to the LogLogic appliance. 34 i5/os Collector Guide

35 Log Data Formatting i5/os jobs captured by the QHST and QAUDJRN logs are stored as undelimited, binary data. LogLogic requires that log data be in an ASCII format in order to take advantage of the LogLogic Appliance search and Agile Reporting Engine capabilities. The data handler uses data formatters to transform the binary data to ASCII-convertible data. The data formatters use predefined rules to add delimiters, map data fields, add control information, and include Syslog header information. In addition, the data formatters extract the timestamp from the original log message and adds it to the newly converted log message. The timestamp is specified as format date, time, and UTC offset: YYYY/MM/DD HH:MM:SS +/-HH:MM Note: Each data formatter references a mapping file containing rules that define how to map data from binary to a readable format. In some cases, you may want to modify the mapping rules to identify data that you do not need to parse or to modify the naming conventions output to the LogLogic Appliance. Cautiously modify the mapping file as it affects what data the LogLogic Appliance captures. Transport Data Queue The data queue is a collection point for the i5/os Collector and receives formatted log data from the QHST and QAUDJRN data formatters. Log data resides on the data queue until it is pulled off by the Transport Server to be sent to the LogLogic Appliance. Log data is processed by the Transport Server in real-time and messages cannot exceed 64k in message length. Note: The data queue can handle up to 2 gigabytes (GB) as defined by the machine running the i5/ OS operating system. Once the queue reaches 2GB in size, the data formatters stop sending data and shut down. New log messages are not lost however as the data handlers maintain a record of the last message processed from the QHST and QAUDJRN logs. Log data is removed from the data queue as it is pulled to the Transport Server for transfer the LogLogic Appliance. The Data Queue does not maintain a record of transferred log data as this is managed by the data handlers. Transport Server The Transport Server converts log data from binary (EBCDIC) to ASCII format and manages the connections between the machine running the i5/os operating system and the appropriate LogLogic Appliance. Formatted log data is picked up from the Transport Server and then converted prior to being sent to the appropriate LogLogic appliance using TCP UDP. The data conversion is handled by pre-defined rules as specified by the configured source and destination Coded Character Set ID (CCSID). IMPORTANT! If the network path between the i5/os system and the LogLogic appliance loses connection, the Transport Server stops sending data. If the network path is valid, but the LogLogic appliance is down, the Transport Server continues to send SYSLOG messages. For information on recovering lost log messages, see Understanding Data Recovery on page 36. i5/os Collector Guide 35