Sample event message for IBM Storage Protect

The following sample event message shows events that are collected from IBM Storage Protect.

Sample 1

<86>Aug 23 09:55:54 ibm.storageprotect.test sshd[2219152]: Connection closed by invalid user Administrator 10.0.0.2 port 52887 [preauth]

Table 1. Highlighted values in the IBM Storage Protect sample event

QRadar field name	Highlighted payload field name
Event ID	Connection closed
Source IP	10.0.0.2
Source Port	52887

Sample 2

<11>Aug 23 09:57:28 ibm.storageprotect.test dsmserv[1838509]: IBM-STORAGEPROTECT-TEST-01: ANR8213E Socket 93 aborted due to send error; error 104.

Table 2. Highlighted values in the IBM Storage Protect sample event

QRadar field name	Highlighted payload field name
Event ID	ANR8213E