topic Re: How to send data from IBM AS400 to Splunk via syslog? in Getting Data In

How to send data from IBM AS400 to Splunk via syslog?

Afef — Thu, 30 Apr 2015 09:48:55 GMT

I want to create a connectivity between splunk enterprise and AS400. I tried to send logs via syslog, but Splunk didn’t receive any data.

Could you help me please?

Thanks

Re: How to send data from IBM AS400 to Splunk via syslog?

vganjare — Thu, 30 Apr 2015 10:08:21 GMT

Hi,

Can this help?

http://answers.splunk.com/answers/25008/as400-for-splunk-app-how-is-data-collected-on-the-as-400.html

Thanks!!

Re: How to send data from IBM AS400 to Splunk via syslog?

Afef — Thu, 30 Apr 2015 10:13:36 GMT

Hi,

Thanks. I tried that but no i can't data in 😕

Re: How to send data from IBM AS400 to Splunk via syslog?

gwalford — Tue, 15 Sep 2015 21:11:20 GMT

The best answer to this question I have seen is to use a third-party application that runs on the iSeries and converts the iSeries data to Syslog in key value pairs - Splunk then ingests this Syslog data. Since it is Key Value paired Splunk easily ingests the data and provides a near to real time integration.

Realistically, you are looking at anywhere between 5 to 30 seconds of log delay due to queuing from the iSeries systems. However, even with this delay you gain hours of speed over a direct database export every 8 hours or so - it also impacts your Splunk license a lot less.

Re: How to send data from IBM AS400 to Splunk via syslog?

bryanmdietz — Thu, 19 Jul 2018 21:42:21 GMT

If your IBM i is at newer releases, V7.2 or V7.3 and fairly current on PTF's you can send the system audit log to a syslog server.
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/page/DISPLAY_JOURNAL%20(easier%20searches%20of%20Audit%20Journal)

and the QHST history log:
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/page/QSYS2.HISTORY_LOG_INFO%20UDTF

Re: How to send data from IBM AS400 to Splunk via syslog?

bryanmdietz — Thu, 19 Jul 2018 21:43:21 GMT

If your IBM I system is at newer releases, V7.2 or V7.3 and fairly current on PTF's you can send the system audit log to a syslog server.
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/page/DISPLAY_JOURNAL%20(easier%20searches%20of%20Audit%20Journal)

and the QHST history log:
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/page/QSYS2.HISTORY_LOG_INFO%20UDTF

Re: How to send data from IBM AS400 to Splunk via syslog?

garapathis — Thu, 26 Jul 2018 03:17:01 GMT

can you please help me understand how to send system audit log to syslog server.
I am new to splunk and trying to understand how to basically access AS400 from splunk.,Can someone please help me on how we can send the system audit log to a syslog server .....

Re: How to send data from IBM AS400 to Splunk via syslog?

micahkemp — Thu, 26 Jul 2018 04:34:33 GMT

@garapathis,

This question is over 3 years old, and is unlikely to attract sufficient attention to answer any question you may have. I suggest submitting a new question.