IBM Support

QRadar: Unexpected AJLIB error reason code 5 when configuring event collection for IBM i (AS400) systems

Troubleshooting


Problem

When administrators attempt to set up an IBM i (AS400) integration with QRadar, the IFS directory must be restored. If this step is not completed, then the error "Format of output file AUDITJRN in library AJLIB not valid, reason code 5," might be displayed.

Symptom

The following error message is displayed:

Text version of the error message: 
ajlib/auditjrn
Member AUDITDTA file AUDITDTA in AJLIB cleared.
Member AUDITJRN file AUDITJRN in AJLIB cleared.
Format of output file AUDITJRN in libray AJLIB not valid, reason code 5
Member FTPOUT file FTPSOURCE in AJLIB cleared.
Member AUDITJRN file AUDITJRN in AJLIB cleared.
Member AUDITDTAF file AUDITDTAF in AJLIB cleared.

This issue can also be confirmed if the user attempts to put a physical file on the AS400 server in the ajlib/auditdtaf directory. 
Enter an FTP subcommand,
put ajlib/auditdtaf filename.txt
No such path or directory: ajlib/auditdtaf

 

Cause

The IFS directory must be restored after you install the AJLIB.savf file.

Environment

IBM i (AS400) V6R1 server.

Resolving The Problem

If this error message occurs, the administrator must restore the IFS directory on the AS400 server to complete the installation. The restoration of the IFS directory does not reset the AJLIB library, it creates the necessary directory for data transfers in addition to restoring the components needed for secure FTP support.
  1. Log in to your IBM i (AS400) server with the audit data.
  2. Type the following command to restore the IFS directory: 
    RST DEV('/qsys.lib/ajlib.lib/ajifs.file') OBJ(('/ajlib'))

    Results
    Attempt to run the AJLIB/SETUP command and ensure it completes successfully. If you continue to experience issues, confirm you completed all of the integration steps per the QRadar DSM Guide for IBM i or contact support for further assistance.

Related Information

AS/400 Commonly Asked Questions

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
10 May 2022

UID

swg21686900

Page Feedback