# AIX syslog to siem server **URL:** \ **Category:** AIX\ **Created:** [June 4, 2021, 10:48am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964 "2021-06-04T10:48:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 4, 2021, 10:48am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/1 "2021-06-04T10:48:32Z")
Hi all, I have some issue when sending AIX syslog to siem server, perhaps somebody can advise if I am doing it wrong. We configured the syslog.conf and added the last line: ``` *.info;auth.*;mail.none;cron.none @ ``` After adding the last line, we did `refresh -s syslogd`. However, when I do a `tcpdump` on the siem server, we did not see any logs coming in. We have also isolate the issue regarding the firewall as it is the same segment as the AIX. So right now, I am scratching my head and thinking it could be the syslog.conf that could have some error. Thank you in advances for the help! ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 4, 2021, 12:17pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/2 "2021-06-04T12:17:48Z")
> [@dereklsl](#): > > Thank you in advances for the help! Maybe provide us some logfile entries for the local server where syslog is of interest so we can see the exact format of the syslog entries you wish to redirect to another server? ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 4, 2021, 1:41pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/3 "2021-06-04T13:41:56Z")
Hi Neo, Thanks for the response. Correct me if I'm wrong but when you mention logfile entries, do you mean the log where it writes to? If so, the auth is the most important part of the logs that we would like to capture. ``` auth.crit;auth.notice;auth.info;auth.warn /var/spool/syslog/auth.messages *.info /var/spool/syslog/syslog.all.info ``` Thanks in advance again! ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 4, 2021, 3:26pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/4 "2021-06-04T15:26:03Z")
> [@dereklsl](#): > > `/var/spool/syslog/auth.messages` Yes, it would be good if you could post the entries of interest from this `logfile` above so we can see the data. When you say the `auth` entries, that's fine but let's actually see what they are to make sure they are logging locally before worrying about remote logging. I'm a simple person 🙂 and tend to troubleshoot things one step-at-a-time, confirming each step along the way. ---
**Author:** ![MadeInGermany](https://community.unix.com/letter_avatar/madeingermany/32/6_22734026db12803ebb3e059622ac3534.png) [@MadeInGermany](https://community.unix.com/u/MadeInGermany)\ **Post date:** [June 4, 2021, 3:36pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/5 "2021-06-04T15:36:41Z")
I think the syntax of your syslog.conf line is okay. Ensure that in each line the fields are separated by TABs only - no space characters allowed! In case the syslogd uses an old hostname resolver, try `@loghost` and map the `loghost` to an IP address in /etc/hosts. ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 4, 2021, 4:15pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/6 "2021-06-04T16:15:54Z")
> [@MadeInGermany](#): > > Ensure that in each line the fields are separated by TABs only - no space characters allowed! According to the IBM AIX man page for syslog.conf > The fields must be separated by one or more tabs or spaces. See Also: [https://www.ibm.com/docs/en/aix/7.1?topic=files-syslogconf-file](https://www.ibm.com/docs/en/aix/7.1?topic=files-syslogconf-file) ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 7, 2021, 6:17am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/7 "2021-06-07T06:17:53Z")
Hi Neo, Sorry for the late reply. Here are some log entries which I have filtered some of the important info away for auth logs: Auth.Message ``` Jul 4 11:11:11 abc auth|security:crit sshd[12345678]: fatal: Failed to change password Jul 3 11:11:15 abc auth|security:crit sshd[12345678]: fatal: Failed to change password Jun 1 10:59:31 abc auth|security:err|error sshd[12345678]: error: buffer_get_string_ret: bad string length 123456780 Jun 2 10:59:31 abc auth|security:crit sshd[12345678]: fatal: buffer_get_cstring: buffer error ``` syslog.all.info ``` Jun 2 10:27:32 abc auth|security:info syslog: ssh: failed login attempt for root from abc.com.sg Jun 3 10:27:34 abc auth|security:info sshd[23331066]: Accepted password for root from abc port 1234568 ssh Jun 4 10:29:36 abc user:info ftp[1234567]: ftp: IMPORT user root, host abc.com.sg, local -, remote NULL. Jun 5 10:29:48 abc user:info ftp[1234567]: ftp: EXPORT user root, host abc.com.sg, local auth.messages, remote auth.messages. Jun 6 10:29:48 abc user:info ftp[1234567]: ftp: EXPORT user root, host abc.com.sg, local syslog.all.error, remote syslog.all.error. ``` I believe it is writing into the logfile entries. ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 7, 2021, 6:23am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/8 "2021-06-07T06:23:28Z")
Hi MadeInGermany, We actually use the ip address instead of the hostname to rule out the resolver. Does this work too? Thank you for the advise once again 🙂 ---
**Author:** ![MadeInGermany](https://community.unix.com/letter_avatar/madeingermany/32/6_22734026db12803ebb3e059622ac3534.png) [@MadeInGermany](https://community.unix.com/u/MadeInGermany)\ **Post date:** [June 7, 2021, 7:05am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/9 "2021-06-07T07:05:28Z")
If syslogd uses [gethostbyname](http://www.nsc.ru/cgi-bin/www/unix_help/unix-man?gethostbyname+3) then it needs a hostname not an IP address. The man pages given by @Neo only say "hostname"... (Currently I do not have access to an AIX system.) ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 7, 2021, 10:13am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/10 "2021-06-07T10:13:55Z")
Hi MadeInGermany, Alright, let me try out adding the hostname instead of the IP Address and map the /etc/hosts to the IP Address. Finger cross, hopefully it will work. Thank you. ---
**Author:** ![vbe](https://community.unix.com/user_avatar/community.unix.com/vbe/32/266_2.png) [@vbe](https://community.unix.com/u/vbe)\ **Post date:** [June 7, 2021, 12:39pm UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/12 "2021-06-07T12:39:39Z")
Not once have you show us your syslog.conf file, if it like some of AIX conf file an error at one point will leave the rest to not be taken in account, knowing how it can be delicate to configure correctly under AIX to have all the logs working properly, I would start by something simple that works and add an new line one at a time in order to solve such issue Then just one log sending to siem server before adding like you did, there is maybe some tricks in syntax you are not respecting So once a good syslog.conf working locally I would add ``` auth.info @ ``` and if that work add to it one new item at a time and test each time Yes in IBM doc I have it says IP address so I don't believe the issue is there ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 8, 2021, 8:09am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/13 "2021-06-08T08:09:22Z")
Hi Vbe, Here's the syslog.conf file. Alright let me try adding just \*.info to see if it works. ``` aso.notice /var/log/aso/aso.log rotate size 1m files 8 compress aso.info /var/log/aso/aso_process.log rotate size 1m files 8 compress aso.debug /var/log/aso/aso_debug.log rotate size 32m files 8 compress caa.debug /var/adm/ras/syslog.caa rotate size 10m files 10 compress user.debug /var/spool/syslog/syslog.userauth.debug auth.debug /var/spool/syslog/syslog.userauth.debug mail.debug /var/spool/syslog/syslog.mail.debug kern.crit /var/spool/syslog/syslog.kerndae.crit daemon.debug /var/spool/syslog/syslog.daemon.debug daemon.crit /var/spool/syslog/syslog.daemon.crit daemon.info /var/spool/syslog/syslog.daemon.info mail.crit /var/spool/syslog/syslog.mail.crit auth.crit;auth.notice;auth.info;auth.warn /var/spool/syslog/auth.messages *.err /var/spool/syslog/syslog.all.error kern.debug /var/spool/syslog/syslog.kern.debug daemon.notice /var/spool/syslog/syslog.daemon.notice *.info /var/spool/syslog/syslog.all.info *.alert /var/spool/syslog/syslog.all.alert *.warn /var/spool/syslog/syslog.all.warn lpr.* /dev/null *.info;auth.*;mail.none @ ``` ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 8, 2021, 8:34am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/14 "2021-06-08T08:34:18Z")
Also, @dereklsl I notice you did not show the IP address in your syslog.conf file. In assume in the actual file you have the IP address and port number? Can you ping that ip\_address:port from the main server? ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 8, 2021, 9:37am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/15 "2021-06-08T09:37:30Z")
Hi @Neo , yup, we are able to ping the ip address from the server. ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 8, 2021, 9:47am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/16 "2021-06-08T09:47:09Z")
> [@dereklsl](#): > > yup, we are able to ping the ip address from the server. How about with the port number, for example: ```plaintext traceroute -p port_number ip_address ``` ? See also: [https://www.ibm.com/docs/ssw\_aix\_72/t\_commands/traceroute.html](https://www.ibm.com/docs/ssw_aix_72/t_commands/traceroute.html) ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 8, 2021, 9:50am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/17 "2021-06-08T09:50:47Z")
> [@dereklsl](#): > > siem server ... this "siem server" is also AIX, same version? ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 8, 2021, 10:39am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/18 "2021-06-08T10:39:34Z")
Hi Everyone, I managed to get it to work. My apologies for not stating the proper information from the start but the IP Address has a port beside it and it seems like syslogd does not like it. The changed made was from: ``` *.info;auth.*;mail.none @ ``` to: ``` *.info;auth.*;mail.none @IPAddress ``` Really appreciate your help on the advice that was given to me and really sorry to have trouble you all 🙇‍♂️ ---
**Author:** ![vbe](https://community.unix.com/user_avatar/community.unix.com/vbe/32/266_2.png) [@vbe](https://community.unix.com/u/vbe)\ **Post date:** [June 8, 2021, 10:41am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/19 "2021-06-08T10:41:02Z")
That is what I wondered when I saw the port number... I have seen nothing in the docs mentioning you could customise... ---
**Author:** ![dereklsl](https://community.unix.com/letter_avatar/dereklsl/32/6_22734026db12803ebb3e059622ac3534.png) [@dereklsl](https://community.unix.com/u/dereklsl)\ **Post date:** [June 8, 2021, 10:43am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/20 "2021-06-08T10:43:39Z")
Yeah it's a silly mistake which I was trying to follow the rsyslog format. At least I understand what to do now in future 😃 ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [June 8, 2021, 10:47am UTC](https://community.unix.com/t/aix-syslog-to-siem-server/382964/21 "2021-06-08T10:47:18Z")
Closed on June 8, 2021, 10:47am UTC