Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

IBM WebSphere Application Server

 

The IBM®WebSphere® Application Server DSM for JSA accepts events using the log file protocol source.

JSA records all relevant application and security events from the WebSphere® Application Server log files.

Configuring IBM WebSphere

You can configure IBM®WebSphere® Application Server events for JSA.

  1. Using a web browser, log in to the IBM® WebSphere® administrative console.
  2. Click Environment >WebSphere Variables.
  3. Define Cell as the Scope level for the variable.
  4. Click New.
  5. Configure the following values:
    • Name Type a name for the cell variable.

    • Description Type a description for the variable (optional).

    • Value Type a directory path for the log files.

    For example:

    {QRADAR_LOG_ROOT} = /opt/IBM/WebSphere/AppServer/profiles/Custom01/logs/QRadar

    You must create the target directory that is specified in Step 5 before proceeding.

  6. Click OK.
  7. Click Save.
  8. You must restart the WebSphere® Application Server to save the configuration changes.Note

    If the variable you created affects a cell, you must restart all WebSphere® Application Servers in the cell before you continue.

You are now ready to customize the logging option for the IBM®WebSphere® Application Server DSM.

Customizing the Logging Option

You must customize the logging option for each application server WebSphere® uses and change the settings for the JVM Logs (Java Virtual Machine logs).

  1. Select Servers >Application Servers.
  2. Select your WebSphere® Application Server to load the server properties.
  3. Select Logging and Tracing >JVM Logs.
  4. Configure a name for the JVM log files.

    For example:

    System.Out log file name:

    ${QRADAR_LOG_ROOT}/${WAS_SERVER_NAME}-SystemOut.log

    System.Err log file name:

    ${QRADAR_LOG_ROOT}/${WAS_SERVER_NAME}-SystemErr.log

  5. Select a time of day to save the log files to the target directory.
  6. Click OK.
  7. You must restart the WebSphere® Application Server to save the configuration changes.Note

    If the JVM Logs changes affect the cell, you must restart all of the WebSphere® Application Servers in the cell before you continue.

    You are now ready to import the file into JSA using the log file protocol.

Creating a Log Source

The log file protocol allows JSA to retrieve archived log files from a remote host. The IBM®WebSphere® Application Server DSM supports the bulk loading of log files by using the log file protocol source.

  1. Log in to JSA.
  2. Click the Admin tab.
  3. Click the Log Sources icon.
  4. Click Add.
  5. In the Log Source Name field, type a name for the log source.
  6. In the Log Source Description field, type a description for the log source.
  7. From the Log Source Type list, select IBM® WebSphere® Application Server.
  8. Using the Protocol Configuration list, select Log File.
  9. Configure the following values:

    Table 1: Log File Parameters

    Parameter

    Description

    Log Source Identifier

    Type an IP address, host name, or name to identify your IBM®WebSphere® Application Server as an event source in JSA. IP addresses or host names are recommended as they allow JSA to identify a log file to a unique event source.

    For example, if your network contains multiple IBM®WebSphere® Application Serves that provides logs to a file repository, specify the IP address or host name of the device that created the event log. This allows events to be identified at the device level in your network, instead of identifying the file repository.

    Service Type

    From the list, select the protocol that you want to use when retrieving log files from a remove server. The default is SFTP.

    • SFTP SSH File Transfer Protocol

    • FTP File Transfer Protocol

    • SCP Secure Copy

    The underlying protocol that is used to retrieve log files for the SCP and SFTP service type requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.

    Remote IP or Hostname

    Type the IP address or host name of your IBM®WebSphere® Application Server storing your event log files.

    Remote Port

    Type the TCP port on the remote host that is running the selected Service Type. The valid range is 1 - 65535.

    The options include FTP ports:

    • FTP TCP Port 21

    • SFTP TCP Port 22

    • SCP TCP Port 22

    If the host for your event files is using a non-standard port number for FTP, SFTP, or SCP, you must adjust the port value.

    Remote User

    Type the user name necessary to log in to the host that contains your event files.

    The user name can be up to 255 characters in length.

    Remote Password

    Type the password necessary to log in to the host.

    Confirm Password

    Confirm the password necessary to log in to the host.

    SSH Key File

    If you select SCP or SFTP as the Service Type, this parameter allows for the definition of an SSH private key file.

    The Remote Password field is ignored when you provide an SSH Key File.

    Remote Directory

    Type the directory location on the remote host to the cell and file path you specified in Configuring IBM WebSphereYou can configure IBM WebSphere Application Server events for JSA.. This is the directory that you created containing your IBM®WebSphere® Application Server event files.

    For FTP only. If your log files are located in the remote user's home directory, you can leave the remote directory blank. This is to support operating systems where a change in the working directory (CWD) command is restricted.

    Recursive

    Select this check box if you want the file pattern to search sub folders. By default, the check box is clear.

    The Recursive option is ignored if you configure SCP as the Service Type.

    FTP File Pattern

    If you select SFTP or FTP as the Service Type, this option allows for the configuration of the regular expression (regex) to filter the list of files that are specified in the Remote Directory. All matching files are included in the processing.

    The FTP file pattern that you specify must match the name that you assigned to your JVM logs in Customizing the Logging OptionYou must customize the logging option for each application server WebSphere uses and change the settings for the JVM Logs (Java Virtual Machine logs).. For example, to collect system logs, type the following code:

    System.*\.log

    Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

    FTP Transfer Mode

    This option appears only if you select FTP as the Service Type. The FTP Transfer Mode parameter allows for the definition of the file transfer mode when log files are retrieved over FTP.

    From the list, select the transfer mode that you want to apply to this log source:

    • Binary Select Binary for log sources that require binary data files or compressed zip, gzip, tar, or tar+gzip archive files.

    • ASCII Select ASCII for log sources that require an ASCII FTP file transfer.

    You must select None for the Processor parameter and LINEBYLINE the Event Generator parameter when you use ASCII as the FTP Transfer Mode.

    SCP Remote File

    If you select SCP as the Service Type you must type the file name of the remote file.

    Start Time

    Type the time of day you want the processing to begin. This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files. Type the start time, based on a 24-hour clock, in the following format: HH: MM.

    Recurrence

    Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D). For example, type 2H if you want the directory to be scanned every 2 hours. The default is 1H.

    When you schedule a log file protocol, select a recurrence time for the log file protocol shorter than the scheduled write interval of the WebSphere® Application Server log files. This ensures that WebSphere® events are collected by the log file protocol before the new log file overwrites the old event log.

    Run On Save

    Select this check box if you want the log file protocol to run immediately after you click Save. After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule.

    Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File parameter.

    EPS Throttle

    Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 - 5000.

    Processor

    If the files on the remote host are stored in a zip, gzip, tar, or tar+gzip archive format, select the processor that allows the archives to be expanded and the contents to be processed.

    Ignore Previously Processed File(s)

    Select this check box to track files that are processed. Files that are previously processed are not processed a second time.

    This check box applies only to FTP and SFTP Service Types.

    Change Local Directory?

    Select this check box to define the local directory on your JSA that you want to use for storing downloaded files during processing. We recommend that you leave the check box clear. When the check box is selected, the Local Directory field is displayed, which gives the option of configuring the local directory to use for storing files.

    Event Generator

    From the Event Generator list, select WebSphere®Application Server.

    The Event Generator applies more processing, which is specific to retrieved event files for IBM®WebSphere® Application Server events.

  10. Click Save.
  11. On the Admin tab, click Deploy Changes.

    The configuration is complete. For more information about IBM® WebServer Application Server, see your vendor documentation.