News
Abstract
IBM Guardium team has identified issues with Remote Syslog affecting Guardium Data Protection systems upgraded to 12.0p240. Customers may experience either loss of existing Remote Syslog configuration settings or incorrectly formatted Remote Syslog messages that appear as "undefined" in external SIEM platforms such as Splunk.
Local Guardium logging is not affected. Customers who are not using Remote Syslog Forwarding are not affected.
Content
12.0p240 introduced changes to the Remote Syslog infrastructure (rsyslog). Due to an incorrect template name specified in the remote logging configuration, remote syslog messages may be sent without the expected information. As a result, downstream SIEM and syslog platforms may be unable to parse the messages correctly. Local syslog records continue to display correctly on the Guardium appliance.
In some cases, existing Remote Syslog configuration settings may be cleared. Following the upgrade, Remote Syslog forwarding may no longer be configured as expected, preventing alerts and audit data from being forwarded to external logging systems.
Local Guardium logging is not affected. Customers who are not using Remote Syslog Forwarding are not affected.
To prevent further exposure to these issues, Guardium appliance patch 12.0p240 is being removed from Fix Central and Passport Advantage. An updated 12.0p240 patch will be released shortly to address the issues above.
Resolution
IBM has identified the root cause and is actively developing corrective actions.
For environments that have already upgraded to 12.0p240:
- IBM has released patch 12.0p1064, which addresses identified Remote Syslog issues reported in 12.0p240. The patch is available on Fix Central ( 12.0p1064 ).
For environments that have not yet installed 12.0p240:
- IBM has released patch 12.0p7240, which supersedes 12.0p240. The patch is available on Fix Central (12.0p7240 ).
Was this topic helpful?
Document Information
Modified date:
19 October 2026
UID
ibm17292245