Oracle BEA WebLogic
The Oracle BEA WebLogic DSM allows JSA to retrieve archived server logs and audit logs from any remote host, such as your Oracle BEA WebLogic server.
JSA uses the log file protocol to retrieve events from your Oracle BEA WebLogic server and provides information on application events that occur in your domain or on a single server.
JSA supports Oracle events by using the Log File protocol from Oracle BEA Weblogic v12.2.1.3.0.
To integrate Oracle BEA WebLogic events, take the following steps:
Enable auditing on your Oracle BEA WebLogic server.
Configure domain logging on your Oracle BEA WebLogic server.
Configure application logging on your Oracle BEA WebLogic server.
Configure an audit provider for Oracle BEA WebLogic.
Configure JSA to retrieve log files from Oracle BEA WebLogic.
Enabling Event Logs
By default, Oracle BEA WebLogic does not enable event logging.
To enable event logging on your Oracle WebLogic console:
Log in to your Oracle WebLogic console user interface.
Select Domain >Configuration >General.
Click Advanced.
From the Configuration Audit Type list, select Change Log and Audit.
Click Save.
You can now configure the collection of domain logs for Oracle BEA WebLogic.
Configuring Domain Logging
Oracle BEA WebLogic supports multiple instances. Event messages from instances are collected in a single domain-wide log for the Oracle BEA WebLogic server.
To configure the log file for the domain:
From your Oracle WebLogic console, select Domain >Configuration >Logging.
From the Log file name parameter, type the directory path and file name for the domain log.
For example, OracleDomain.log.
Configure any additional domain log file rotation parameters.
Click Save.
You can now configure application logging for the server.
Configuring Application Logging
You can configure application logging for Oracle BEA WebLogic:
From your Oracle WebLogic console, select Server >Logging >General.
From the Log file name parameter, type the directory path and file name for the application log.
For example, OracleDomain.log.
Configure any additional application log file rotation parameters.
Click Save.
You can now configure an audit provider for Oracle BEA WebLogic.
Configuring an Audit Provider
You can configure an audit provider:
Select Security Realms >Realm Name >Providers >Auditing.
Click New.
Configure an audit provider by typing a name for the audit provider that you are creating.
From the Type list, select DefaultAuditor.
Click OK.
The Settings window is displayed.
Click the auditing provider that you created in Configuring an Audit Provider.
Click the Provider Specific tab.
Add any Active Context Handler Enteries that are needed.
From the Severity list, select Information.
Click Save.
You can now configure JSA to pull log files from Oracle BEA WebLogic.
Log File Log Source Parameters for Oracle BEA WebLogic
If JSA does not automatically detect the log source, add a Oracle BEA WebLogic log source on the JSA Console by using the Log file protocol.
When using the Log file protocol, there are specific parameters that you must use.
The following table describes the parameters that require specific values to collect log file events from Oracle BEA WebLogic:
Parameter |
Value |
|---|---|
Log Source type |
Oracle BEA WebLogic |
Protocol Configuration |
Log file |
Log Source Identifier |
Type the IP address or host name for the log source. This value must match the value that is configured in the Remote Host IP or Hostname parameter. The log source identifier must be unique for the log source type. |
Event Generator |
From the Event Generator list, select Oracle BEA WebLogic. |
Oracle BEA WebLogic Sample Event Messages
Use these sample event messages to verify a successful integration with JSA.
Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.
Oracle BEA WebLogic sample messages when you use the Log File protocol
Sample 1: The following sample event shows that the server has successfully established a connection with the domain level diagnostic service.
####<Oct 15, 2012 4:27:41 PM MST> <Notice> <Log Management> <qradarTesting.qradar.test> <sgss_ManagedServer_1> <[STANDBY] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1350343661416> <BEA-170027> <The Server has established connection with the Domain level Diagnostic Service successfully.>
Sample 2: The following sample event shows that the NetUIx container is initializing.
####<Dec 17, 2012 1:51:34 PM MST> <Info> <netuix> <qradarTesting.qradar.test> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (selftuning)& apos;> <<anonymous>> <> <> <1355777494726> <BEA-423101> <<[consolehelp] Initializing the NetUIx container>
Sample 3: The following sample event shows that a node manager command has failed.
####<Oct 15, 2012 4:19:42 PM MST> <Error> <NodeManager> <qradarTesting.qradar.test> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (selftuning)& apos;> <weblogic> <> <> <1350343182323> <BEA-300033> <Could not execute command "getVersion" on the node manager. Reason: "Connection refused. Could not connect to NodeManager. Check that it is running at localhost:5556.".>