Enterasys Security Information and Event Manager, Configuration Manual

Page: 168 / 426

Configuring DSMs
152 IBM
This document includes:
•
Configuring IBM IMS to Integrate with SIEM
•
Pulling Data Using Log File Protocol
Configuring IBM IMS
to Integrate with
SIEM
To integrate IBM IMS with SIEM:
Step 1
From the Enterasys Extranet, download the following compressed file:
QexIMS_bundled.tar.gz
Step 2
On a Linux-based operating system, extract the file:
tar -zxvf qexims_bundled.tar.gz
The following files are contained in the archive:
qexims_jcl.txt - Job Control Language file
qeximsloadlib.trs - Compressed program library (requires IBM TRSMAIN)
qexims_trsmain_JCL.txt - Job Control Language for TRSMAIN to decompress the
.trs file
Step 3
Load the files onto the IBM mainframe using the following methods:
a
Upload the sample
qexims_trsmain_JCL.txt
and
qexims_jcl.txt
files
using the TEXT protocol.
b
Upload the
qeximsloadlib.trs
file using BINARY mode transfer and append
to a pre-allocated data set. The
qeximsloadlib.trs
file is a tersed file
containing the executable (the mainframe program QexIMS). When you upload
the .trs file from a workstation, pre-allocate a file on the mainframe with the
following DCB attributes: DSORG=PS, RECFM=FB, LRECL= 1024,
BLKSIZE=6144. The file transfer type must be binary and not text.
NOTE
QexIMS is a small C mainframe program that reads the output of the IMS log file
(EARLOUT data) line by line. QexIMS adds a header to each record containing
event information, for example, record descriptor, the date, and time. The program
places each field into the output record, suppresses trailing blank characters, and
delimits each field with the pipe character. This output file is formatted for SIEM
and the blank suppression reduces network traffic to SIEM. This program does
not consume CPU or I/O disk resources.
Step 4
Customize the
qexims_trsmain_JCL.txt
file according to your installation
specific information for parameters.
For example, jobcard, data set naming conventions, output destinations, retention
periods, and space requirements.
The
qexims_trsmain_JCL.txt
file uses the IBM utility TRSMAIN to extract the
program stored in the
qeximsloadlib.trs
file.
An example of the
qexims_trsmain_JCL.txt
file includes: