Getting Data In

How to get data from the AIX errpt into Splunk?

sbennacer_splun
Splunk Employee
Splunk Employee

How to get data from the AIX errpt into Splunk?

Tags (2)
0 Karma

sbennacer_splun
Splunk Employee
Splunk Employee

The errpt is command to generate a report of logged errors, you can send the result to splunk in different way , you can use a forwarder to forward the generated report of logged errors to Splunk
Or you can create and ODM entry to run the logger command whenever an error is logged
1. Create an ODM entry to run the "logger" command whenever an error is logged.

    # vi /tmp/syslog.add
    errnotify:
            en_name="syslog1"
            en_persistenceflg = 1
          en_method = "logger -pnotice Msg from Error Log: $(errpt -a -l $1 | grep -v 'ERROR_ID TIMESTAMP’)"
  1. Add the entry to ODM

    # odmadd /tmp/syslog.add
    
  2. Add a syslog entry to forward "notice" priority messages to splunk host “splunkhost "

    # vi /etc/syslog.conf
    *.notice        @splunkhost:port
    
  3. Refresh the syslog demon to pick up the new entry

    refresh -s syslogd

  4. In Splunk you will need to create new data input for syslog following the doc http://docs.splunk.com/Documentation/Storm/Storm/User/Howtosetupsyslog

note : IBM link about errpt command
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds2...

barberoon
New Member

Why wouldn't you just use syslog.config entry "*.err @splunkhost:port" or does this give different results?

0 Karma

liupeng0518
New Member

But there have a problem, the log not format, all in a line:

Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Fri Sep 2 15:33:12 CST 2016 Sequence Number: 77 Machine Id: 00FA6AD04C00 Node Id: PDC_F1M3_C04_P02_zabbixtest Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a Error log test. 
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...