Topic
2 replies Latest Post - ‏2013-11-11T20:35:27Z by --Craig
whan3
whan3
1 Post
ACCEPTED ANSWER

Pinned topic How to enable sending events to Syslog on Common Agent

‏2013-10-14T08:49:01Z |

One of our System X server has IBM System Director Common Agent installed, and we want to enable sending all events to SysLog (same System X which common agent is installed),  how could we do it by using tools or scripts provided by Common Agent?

Does anyone have detailed documentation to explain how to use common agent command such as agentcli.sh?

Note: only common agent is available, no Director server installed or available to assist in this implementation.

  • RS_UK_HAL
    RS_UK_HAL
    190 Posts
    ACCEPTED ANSWER

    Re: How to enable sending events to Syslog on Common Agent

    ‏2013-10-24T11:56:59Z  in response to whan3

    Surely throwing ISD Server on a VM somewhere would be the easiest way to do this; there's a specific Event Automation Plan Action for sending native events to a syslog server.

    Furthermore, doing it via an ISD Server would mean that you can filter the events, before sending them, to prevent your syslog server from being flooded with every single event generated by the Common Agent.

    Alternatively, you could try using the CIMSUBSCRIBE command, which allows for "handlers" (why such cryptic names for setting up a config change?!) to be set-up to forward Common Agent events (directly) to a chosen destination, such as SNMP receiver or "Log consumer".  Link is:

    http://pic.dhe.ibm.com/infocenter/director/pubs/topic/com.ibm.director.cli.helps.doc/fqm0_r_cli_cimsubscribe.html

    A few things to consider about CIMSUBSCRIBE:

    1.  It was provided with older versions of ISD but I'm not sure it's still there and valid with 6.3.x releases - though it is in its InfoCentre.

    2.  I seem to remember this process of creating "handlers" being moved into Configuration Manager, but don't hold me to that (it's been sometime since I did all this), so you might want to check there, as that would mean creating one template and dumping it to all your Common Agents, versus doing each one manually.

    3.  I'm not even sure that the "Log handler" refers to a syslog.  Again, I honestly can't remember and the InfoCentre is not forthcoming with the details.

    EXTRACT:  -ch -hn "Log" -d "http://localhost:6988/CIMListener/LogConsumer"

    Apologies the alternative suggestion is a bit vague but hope this helps.

     

  • --Craig
    --Craig
    16 Posts
    ACCEPTED ANSWER

    Re: How to enable sending events to Syslog on Common Agent

    ‏2013-11-11T20:35:27Z  in response to whan3

    Without an IBM Systems Director server, the Common Agent provides no additional value over the Platform Agent.

    The Platform Agent should by default include a CIM Subscription for logging events into the local /var/log/messages.  I'm not sure of a way for the Platform Agent to log to a remote SysLog server.