DCO Syslog integration with IBM QRadar

shemil_usman · ‎2020-07-26

Hi,

One of our client wants to configure and enable the syslog to send logs to IBM QRadar from DCO server.

Please find configuration steps given by IBM for the same:

Please advise how to achieve this in DCO.

Can this be done through command console with root access?

Thanks & Regards

Shemil

Jef · ‎2020-08-18

Hi Shemil,

Searching the Internet returns similar guide (such as https://www.server-world.info/en/note?os=CentOS_8&p=rsyslog&f=1) for CentOS (the operating system for DCO). Additional to OS system logs, DCO logs located in locations like /opt/jboss-as/standalone/log and /var/log folders. So those files can be copied to somewhere else if you wish. However sending files (such as log files) from DCO server to another server is not supported. As you might know, DCO has also UI build-in feature to collect log files, it can be accessed from web-client, Administration > Download log files. So moving the files elsewhere may also break this feature.

Kind regards,

Jef

See Answer In Context

Jef · ‎2020-08-18

Hi Shemil,

Searching the Internet returns similar guide (such as https://www.server-world.info/en/note?os=CentOS_8&p=rsyslog&f=1) for CentOS (the operating system for DCO). Additional to OS system logs, DCO logs located in locations like /opt/jboss-as/standalone/log and /var/log folders. So those files can be copied to somewhere else if you wish. However sending files (such as log files) from DCO server to another server is not supported. As you might know, DCO has also UI build-in feature to collect log files, it can be accessed from web-client, Administration > Download log files. So moving the files elsewhere may also break this feature.

Kind regards,

Jef