Configuring your IBM AIX Server device to send syslog events to QRadar

To collect syslog audit events from your IBM® AIX® Server device, redirect your audit log output from your IBM AIX device to the IBM QRadar® Console or Event Collector.


  1. Log in to your IBM AIX appliance as a root user.
  2. Open the /etc/syslog.conf file.
  3. To forward the system authentication logs to QRadar, add the following line to the file: @QRadar_IP_address

    A tab must separate and the IP address of QRadar.

    For example:
    ##### begin /etc/syslog.conf mail.debug /var/adm/maillogmail.none /var/adm/maillogauth.notice /var/adm/authloglpr.debug /var/adm/lpd-errskern.debug /var/adm/messages*.emerg;*.alert;*.crit;*.warning;*.err;*.notice;*.info /var/adm/            @<IP_address>##### end /etc/syslog.conf
  4. Save and exit the file.
  5. Restart the syslog service:

    refresh -s syslogd