QRadar: Troubleshooting IBM AS/400 iSeries QRadar Integrations

Resolving The Problem

The steps provided below outline the installation procedure for the AJLIB.SAVF file when errors occur. These instructions create the necessary directory for data transfers in addition to restoring the components needed for sftp support.

Configure an IBM iSeries to integrate with QRadar

To integrate an IBM iSeries with QRadar.


Procedure
1. From the IBM support website (https://www.ibm.com/support/fixcentral/), download the following files: AJLIB.SAVF.
2. Copy the AJLIB.SAVF file onto a computer or terminal that has FTP access to the IBM AS/400 iSeries.
3. Create a generic online SAVF file on the iSeries using the command: CRTSAVF QGPL/SAVF.
4. Using FTP on the computer or terminal, replace the iSeries generic SAVF with the AJLIB.SAVF file downloaded from IBM Fix Central.
   
   bin
   cd qgpl
   lcd c:\
   put ajlib.savf savf
   quit
   
   If you are transferring your SAVF file from another iSeries, the file must be sent with the required FTP subcommand mode BINARY before the GET or PUT statement.
5. Restore the AJLIB library on the IBM iSeries: RSTLIB.
6. Setup the data collection start date and time for the Audit Journal Library (AJLIB): AJLIB/SETUP.
   
   You are prompted for a username and password. If you start the Audit Journal Collector a failure message is sent to QSYSOPR. The setup function sets a default start date and time for data collection from the Audit Journal to 08:00:00 of the current day.
   
   NOTE: To preserve your previous start date and time information for a previous installation you must run AJLIB/DATETIME. Record the previous start date and time and type those values when you run AJLIB/SETUP. The start date and time must contain a valid date and time in the six character system date and system time format. The end date and time must be a valid date and time or left blank.
   
   
7. Run AJLIB/DATETIME.
   
   This updates the IBM AS/400 iSeries with the data collection start date and time if you made changes.
   
   
8. Type the following command: RST DEV('/qsys.lib/ajlib.lib/ajifs.file') OBJ(('/ajlib')).
   
   NOTE: The RST of the IFS directory does not reset the AJLIB library.
   
   
9. Run AJLIB/AUDITJRN.
   
   This launches the Audit Journal Collection program to gather and send the records to your remote FTP server: If the transfer to the FTP server fails, a message is sent to QSYSOPR. The process for launching AJLIB/AUDITJRN is typically automated by an iSeries Job Scheduler to collect records periodically.
   
   NOTE: If the FTP transfer is successful, the current data and time information is written into the start time for AJLIB/DATETIME to update the gather time and the end time is set to blank. If the FTP transfer fails, the export file is erased and no updates are made to the gather date or time.