Configure AIX server to send logs and auditing to Qradar

Tags
aix, auditing, logs, server

 
Thread Tools Search this Thread
# 1  
Old 12-05-2018
Configure AIX server to send logs and auditing to Qradar

Hi All

I need your help to configure Aix to send logs to Qradar, I did all the methods that mentioned in IBM website and no use, Plz Help,,
The Logs should I receive from Aix and display in Qradar is (create user delete user changing in privileges....etc )

my skype account
khaled_ly84

regards

Last edited by Don Cragun; 12-05-2018 at 03:45 AM.. Reason: Remove tags making entire post bold.
# 2  
Old 12-05-2018
Hi,

Can you post the output of;

Code:
cat /etc/security/audit/streamcmds
cat /etc/security/audit/config

Or check that binmode=off and streammode=on as these are requirements.

Also what if any messages do you get when you run refresh -s syslogd and audit start

Regards

Gull04

Last edited by RudiC; 12-06-2018 at 07:15 AM..
# 3  
Old 12-06-2018
Output


Code:
cat /etc/security/audit/streamcmds

/usr/sbin/auditstream | auditpr -v > /audit/stream.out&
/usr/sbin/auditstream | auditpr -h eclrRdi | /usr/bin/logger -p local0.debug&
/usr/sbin/auditstream | /usr/sbin/auditselect -m -e "command != logger && command != auditstream && command != auditpr && command != auditselect"|auditpr -t0 -h eclrRdi -v |sed -e :a -e '$!N;s/\n / /;ta' -e 'P;D'| /usr/bin/logger -p local0.debug -r &

output


Code:
cat /etc/security/audit/config
 start:
        binmode = off
        streammode = on

bin:
        trail = /audit/trail
        bin1 = /audit/bin1
        bin2 = /audit/bin2
        binsize = 10240
        cmds = /etc/security/audit/bincmds
        freespace = 65536
        backuppath = /audit
        backupsize = 0
        bincompact = off

# refresh -s syslogd
0513-095 The request for subsystem refresh was completed successfully.
# audit start
** auditing enabled already
Invalid argument
#

please if u have a good background about this topic let's have a skybe call




Moderator's Comments:
Mod Comment Please use CODE tags as required by forum rules!

Last edited by RudiC; 12-06-2018 at 07:18 AM.. Reason: Added CODE tags.
# 4  
Old 12-06-2018
Hi,

I think that you need to set the count to your logger command or remove the count switch.

Code:
/usr/sbin/auditstream | /usr/sbin/auditselect -m -e "command != logger && command != auditstream && command != auditpr && command != auditselect"|auditpr -t0 -h eclrRdi -v |sed -e :a -e '$!N;s/\n / /;ta' -e 'P;D'| /usr/bin/logger -p local0.debug -r &

Should read;

Code:
/usr/sbin/auditstream | /usr/sbin/auditselect -m -e "command != logger && command != auditstream && command != auditpr && command != auditselect"|auditpr -t0 -h eclrRdi -v |sed -e :a -e '$!N;s/\n / /;ta' -e 'P;D'| /usr/bin/logger -p local0.debug &

or

Code:
/usr/sbin/auditstream | /usr/sbin/auditselect -m -e "command != logger && command != auditstream && command != auditpr && command != auditselect"|auditpr -t0 -h eclrRdi -v |sed -e :a -e '$!N;s/\n / /;ta' -e 'P;D'| /usr/bin/logger -p local0.debug -r nn &

Where nn is an integer from 1 to 1000.

Hope that this helps.

Regards

Gull04
# 5  
Old 12-07-2018
Thanks alot I will try this then I will revert u back

|
Thread Tools Search this Thread
Search this Thread:
Advanced Search

More UNIX and Linux Forum Topics You Might Find Helpful
User auditing from AIX server Nagesh_1985 AIX 8 07-03-2014 11:25 AM
AIX auditing sunnybee AIX 2 03-04-2014 02:01 PM
Send a file from AIX to PCOMM server targetshell AIX 4 10-09-2013 07:46 AM
Send message from AIX UNIX server rsivasan AIX 4 03-20-2013 11:31 AM
How to send AIX logs to windows thecobra151 AIX 2 03-09-2011 03:51 AM
need to configure mail setting to send mail to outlook mail server amitranjansahu UNIX for Advanced & Expert Users 2 02-18-2011 07:29 AM
AIX auditing m_raheelahmed AIX 0 01-16-2011 02:39 AM
Can't configure sendmail to send mails to external SMTP Server nypreH UNIX for Dummies Questions & Answers 5 12-21-2010 11:46 AM
Send email from sendmail on AIX using exchange server as SMTP server ahmed_salah Shell Programming and Scripting 0 12-09-2010 11:44 AM
How do I configure Linux server to be able to send emails internally? wbdevilliers UNIX for Dummies Questions & Answers 5 01-05-2010 01:04 PM
send mail configuration in AIX server jack00423 AIX 1 08-28-2009 07:52 AM
Server unable to send mail-how to configure Qwerty123 Solaris 6 02-08-2009 11:32 PM
how to configure server to send email in AIX chongkls77 AIX 4 05-07-2008 04:25 AM
Configure AIX v5.1 for send mail gio123bg AIX 0 12-03-2003 11:36 AM
Send email to another server on AIX owls UNIX for Dummies Questions & Answers 1 09-17-2001 01:02 PM