AIX syslog to siem server

UNIX AIX
1

Hi all,

I have some issue when sending AIX syslog to siem server, perhaps somebody can advise if I am doing it wrong.

We configured the syslog.conf and added the last line:

*.info;auth.*;mail.none;cron.none	@<IP Address>

After adding the last line, we did refresh -s syslogd. However, when I do a tcpdump on the siem server, we did not see any logs coming in.

We have also isolate the issue regarding the firewall as it is the same segment as the AIX. So right now, I am scratching my head and thinking it could be the syslog.conf that could have some error.

Thank you in advances for the help!

2

Maybe provide us some logfile entries for the local server where syslog is of interest so we can see the exact format of the syslog entries you wish to redirect to another server?

3

Hi Neo,

Thanks for the response. Correct me if I'm wrong but when you mention logfile entries, do you mean the log where it writes to? If so, the auth is the most important part of the logs that we would like to capture.

auth.crit;auth.notice;auth.info;auth.warn         /var/spool/syslog/auth.messages
*.info          /var/spool/syslog/syslog.all.info

Thanks in advance again!

4

Yes, it would be good if you could post the entries of interest from this logfile above so we can see the data.

When you say the auth entries, that's fine but let's actually see what they are to make sure they are logging locally before worrying about remote logging.

I'm a simple person :slight_smile: and tend to troubleshoot things one step-at-a-time, confirming each step along the way.

5

I think the syntax of your syslog.conf line is okay.
Ensure that in each line the fields are separated by TABs only - no space characters allowed!

In case the syslogd uses an old hostname resolver, try @loghost and map the loghost to an IP address in /etc/hosts.

6

According to the IBM AIX man page for syslog.conf

The fields must be separated by one or more tabs or spaces.

See Also:

https://www.ibm.com/docs/en/aix/7.1?topic=files-syslogconf-file

7

Hi Neo,

Sorry for the late reply. Here are some log entries which I have filtered some of the important info away for auth logs:

Auth.Message

Jul 4 11:11:11 abc auth|security:crit sshd[12345678]: fatal: Failed to change password
Jul 3 11:11:15 abc auth|security:crit sshd[12345678]: fatal: Failed to change password
Jun 1 10:59:31 abc auth|security:err|error sshd[12345678]: error: buffer_get_string_ret: bad string length 123456780
Jun 2 10:59:31 abc auth|security:crit sshd[12345678]: fatal: buffer_get_cstring: buffer error

syslog.all.info

Jun  2 10:27:32 abc  auth|security:info syslog: ssh: failed login attempt for root from abc.com.sg
Jun  3 10:27:34 abc  auth|security:info sshd[23331066]: Accepted password for root from abc port 1234568 ssh
Jun  4 10:29:36 abc  user:info ftp[1234567]: ftp: IMPORT user root, host abc.com.sg, local -, remote NULL.
Jun  5 10:29:48 abc  user:info ftp[1234567]: ftp: EXPORT user root, host abc.com.sg, local auth.messages, remote auth.messages.
Jun  6 10:29:48 abc  user:info ftp[1234567]: ftp: EXPORT user root, host abc.com.sg, local syslog.all.error, remote syslog.all.error.

I believe it is writing into the logfile entries.

8

Hi MadeInGermany,

We actually use the ip address instead of the hostname to rule out the resolver. Does this work too?

Thank you for the advise once again :slight_smile:

9

If syslogd uses gethostbyname then it needs a hostname not an IP address.
The man pages given by @Neo only say "hostname"...
(Currently I do not have access to an AIX system.)

10

Hi MadeInGermany,

Alright, let me try out adding the hostname instead of the IP Address and map the /etc/hosts to the IP Address.

Finger cross, hopefully it will work.

Thank you.

12

Not once have you show us your syslog.conf file, if it like some of AIX conf file an error at one point will leave the rest to not be taken in account, knowing how it can be delicate to configure correctly under AIX to have all the logs working properly, I would start by something simple that works and add an new line one at a time in order to solve such issue
Then just one log sending to siem server before adding like you did, there is maybe some tricks in syntax you are not respecting
So once a good syslog.conf working locally I would add

auth.info            @<IP_address>

and if that work add to it one new item at a time and test each time

Yes in IBM doc I have it says IP address so I don't believe the issue is there

13

Hi Vbe,

Here's the syslog.conf file. Alright let me try adding just *.info to see if it works.

aso.notice /var/log/aso/aso.log rotate size 1m files 8 compress
aso.info /var/log/aso/aso_process.log rotate size 1m files 8 compress
aso.debug /var/log/aso/aso_debug.log rotate size 32m files 8 compress

caa.debug /var/adm/ras/syslog.caa rotate size 10m files 10 compress
user.debug      /var/spool/syslog/syslog.userauth.debug
auth.debug      /var/spool/syslog/syslog.userauth.debug
mail.debug      /var/spool/syslog/syslog.mail.debug
kern.crit       /var/spool/syslog/syslog.kerndae.crit
daemon.debug     /var/spool/syslog/syslog.daemon.debug
daemon.crit     /var/spool/syslog/syslog.daemon.crit
daemon.info     /var/spool/syslog/syslog.daemon.info
mail.crit       /var/spool/syslog/syslog.mail.crit
auth.crit;auth.notice;auth.info;auth.warn       /var/spool/syslog/auth.messages
*.err           /var/spool/syslog/syslog.all.error
kern.debug      /var/spool/syslog/syslog.kern.debug
daemon.notice   /var/spool/syslog/syslog.daemon.notice
*.info          /var/spool/syslog/syslog.all.info
*.alert /var/spool/syslog/syslog.all.alert
*.warn  /var/spool/syslog/syslog.all.warn
lpr.*   /dev/null
*.info;auth.*;mail.none	@<IPAddress:514>
14

Also, @dereklsl

I notice you did not show the IP address in your syslog.conf file. In assume in the actual file you have the IP address and port number?

Can you ping that ip_address:port from the main server?

15

Hi @Neo ,

yup, we are able to ping the ip address from the server.

16

How about with the port number, for example:

traceroute -p port_number  ip_address

?

See also:

https://www.ibm.com/docs/ssw_aix_72/t_commands/traceroute.html

17

... this "siem server" is also AIX, same version?

18

Hi Everyone,

I managed to get it to work. My apologies for not stating the proper information from the start but the IP Address has a port beside it and it seems like syslogd does not like it.

The changed made was from:

*.info;auth.*;mail.none	@<IPAddress:514>

to:

*.info;auth.*;mail.none	@IPAddress

Really appreciate your help on the advice that was given to me and really sorry to have trouble you all :bowing_man:

19

That is what I wondered when I saw the port number... I have seen nothing in the docs mentioning you could customise...

20

Yeah it's a silly mistake which I was trying to follow the rsyslog format. At least I understand what to do now in future :smiley: