Enterasys Security Information and Event Manager, Configuration Manual

Page: 149 / 426

Configuring DSMs
IBM AS/400 iSeries 133
The execution of the setup function sets a default start date and time for data
collection from the Audit Journal to 08:00:00 of the current day.
NOTE
To preserve your previous start date and time information for a previous
installation you must run
AJLIB/DATETIME.
Record the previous start date and
time and type those values when you execute
AJLIB/SETUP
. The start date and
time must contain a valid date and time in the six character system date and
system time format. The end date and time must be a valid date and time or left
blank.
Step 7
Execute
AJLIB/DATETIME.
This updates the IBM AS/400 iSeries with the data collection start date and time if
you made changes.
Step 8
Execute
AJLIB/AUDITJRN.
This launches the Audit Journal Collection program to gather and send the records
to your remote FTP server: If the transfer to the FTP server fails, a message is sent
to QSYSOPR. The process for launching
AJLIB/AUDITJRN
is typically automated
by an iSeries Job Scheduler to collect records periodically.
NOTE
If the FTP transfer is successful, the current data and time information is written
into the start time for
AJLIB/DATETIME
to update the gather time and the end
time is set to blank. If the FTP transfer fails, the export file is erased and no
updates are made to the gather date or time.
Pulling Data Using Log File Protocol
You are now ready to configure the log source and protocol within SIEM:
Step 1
To configure SIEM to receive events from an IBM AS/400 iSeries, you must select
the
IBM AS/400 iSeries option from the Log Source Type drop-down list box.
Step 2
To configure the log file protocol for the IBM AS/400 iSeries DSM, you must select
the
Log File option from the Protocol Configuration drop-down list box and
define the location of your FTP server connection settings.
NOTE
If you are using the PowerTech Interact or LogAgent for System i software to
collect CEF formatted syslog messages, you must select the
Syslog option from
the Protocol Configuration drop-down list box.
Step 3
We recommend when you use the Log File protocol option that you select a secure
protocol for transferring files, such as Secure File Transfer Protocol (SFTP).
For more information on configuring log sources and protocols, see the Log
Sources User Guide .
Configuring Raz-Lee
iSecurity
The Raz-Lee iSecurity for System i user interface allows detailed security audits of
systems for compliance and securing iSeries infrastructure. You can integrate