Configuring IBM Disconnected Log Collector to communicate with QRadar

To forward events to IBM QRadar, you must edit the configuration file on your Disconnected Log Collector (DLC) console.

Before you begin

IBM® Disconnected Log Collector must be configured to collect events and forward them to QRadar. For more information, see the IBM Disconnected Log Collector documentation (https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.dlc.doc/c_dlc_overview.html).

About this task

IBM Disconnected Log Collector 1.5 sends some metric events to QRadar to monitor some key statistics from your Disconnected Log Collector. Disconnected Log Collector sends 3 different metric events once every minute.

The following table describes the 3 metric event types that are sent to QRadar.
Table 1. Metric event types that are sent to QRadar
Component name Metric ID Description
EventProcessingFilterQueue SpillFilesCount If the incoming event rate exceeds the capacity to process the events, the count increases.
ecs-dlc_dlc_TCP_TO_QRADAR SpillFilesCount If DLC is disconnected, or the incoming event rate exceeds outgoing EPS setting in DLC, the count increases.
Source Monitor EventRate The current eps rate that is collected by DLC.

Procedure

  1. Log in to your Disconnected Log console. You must have permission to edit files and restart services.
  2. Go to the /opt/ibm/si/services/dlc/conf/config.json file.
  3. Change the line "DLCMetricsEventsEnabled":false" to "DLCMetricsEventsEnabled":true", and then save your changes.
  4. To restart the Disconnected Log Collector service, type the following command:

    systemctl restart dlc

What to do next

If QRadar does not automatically detect the log source, add a Forwarded log source on the QRadar Console.