How to get data from the AIX errpt into Splunk?

[sbennacer_splun]

How to get data from the AIX errpt into Splunk?

[sbennacer_splun]

The errpt is command to generate a report of logged errors, you can send the result to splunk in different way , you can use a forwarder to forward the generated report of logged errors to Splunk
Or you can create and ODM entry to run the logger command whenever an error is logged
1. Create an ODM entry to run the "logger" command whenever an error is logged.

    # vi /tmp/syslog.add
    errnotify:
            en_name="syslog1"
            en_persistenceflg = 1
          en_method = "logger -pnotice Msg from Error Log: $(errpt -a -l $1 | grep -v 'ERROR_ID TIMESTAMP’)"

1. Add the entry to ODM

   # odmadd /tmp/syslog.add
   

2. Add a syslog entry to forward "notice" priority messages to splunk host “splunkhost "

   # vi /etc/syslog.conf
   *.notice        @splunkhost:port
   

3. Refresh the syslog demon to pick up the new entry

   refresh -s syslogd

4. In Splunk you will need to create new data input for syslog following the doc http://docs.splunk.com/Documentation/Storm/Storm/User/Howtosetupsyslog

note : IBM link about errpt command
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds2...

[barberoon]

Why wouldn't you just use syslog.config entry "*.err @splunkhost:port" or does this give different results?

[liupeng0518]

But there have a problem, the log not format, all in a line:

Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Fri Sep 2 15:33:12 CST 2016 Sequence Number: 77 Machine Id: 00FA6AD04C00 Node Id: PDC_F1M3_C04_P02_zabbixtest Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a Error log test.