Enterasys Security Information and Event Manager, Configuration Manual

Page: 171 / 426

Configuring DSMs
IBM IMS 155
PUT 'Q1JACK.QEXIMS.OUTPUT.C320' /192.168.1.101/IMS/QEXIMS.OUT
PUT.C320
NOTE
You must remove commented lines beginning with //* for the script to properly
forward the output file to the interim FTP server.
You are now ready to configure the Log File protocol. See Pulling Data Using Log
File Protocol .
b
Schedule SIEM to retrieve the output file from IBM IMS.
If the mainframe is configured to serve files through FTP, SFTP, or allow SCP,
then no interim FTP server is required and SIEM can pull the output file directly
from the mainframe. The following text must be commented out using //* or
deleted from the
qexims_jcl.txt
file:
//*FTP EXEC PGM=FTP,REGION=3800K
//*INPUT DD *
//*<target server>
//*<USER>
//*<PASSWORD>
//*ASCII
//*PUT '<IMSOUT>' /TARGET DIRECTORY>/<IMSOUT>
//*QUIT
//*OUTPUT DD SYSOUT=*
//*SYSPRINT DD SYSOUT=*
You are now ready to configure the Log File protocol. See Pulling Data Using Log
File Protocol .
Pulling Data Using
Log File Protocol
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. The IBM IMS DSM supports the bulk loading of log files using the log file
protocol source.
When configuring your IBM IMS DSM to use the log file protocol, make sure the
hostname or IP address configured in the IBM IMS is the same as configured in
the Remote Host parameter in the Log File protocol configuration.
You are now ready to configure the log source and log file protocol within SIEM:
Step 1
To configure SIEM to receive events from the IBM IMS, you must select the IBM
IMS option from the Log Source Type drop-down list box.
Step 2
To configure the log file protocol, you must select the Log File protocol option from
the Protocol Configuration drop-down list box.
For more information on configuring log sources and protocols, see the Log
Sources User Guide .