Security Compliance

Audit IBM iSeries System security events with SEM

This article describes how to audit IBM iSeries System security events with SEM. SEM supports security auditing on IBM iSeries Systems using a third-party log agent. The log agent sends data from the iSeries System to the SEM Appliance. The log agent must be purchased separately from SEM. Some log agents commonly used with SEM include: Alliance Log Agent for IBM i from Townsend Security iSecurity for IBM AS400 from Raz-Lee PowerTech Interact from PowerTech Enforcive Enterprise Security for IBM

First published date

11/29/2018 10:35 PM

Last published date

5/28/2019 3:10 PM

Overview

This article describes how to audit IBM iSeries System security events with Security Event Manager (formerly Log and event Manager). SEM supports security auditing on IBM iSeries Systems using a third-party log agent. The log agent sends data from the iSeries System to the SEM appliance.
 

The log agent must be purchased separately from SEM. Some log agents commonly used with SEM include:

  • Alliance Log Agent for IBM i from Townsend Security
  • iSecurity for IBM AS400 from Raz-Lee
  • PowerTech Interact from PowerTech
  • Enforcive Enterprise Security for IBM i from Enforcive


For a complete list of supported third-party log agents, refer to the SEM Supported Tools List at http://www.solarwinds.com/log-event-manager/data-sources.aspx.

Product section

Security Event Manager

Resolution

Audit requirements 

To enable auditing on the iSeries System, you must:

  • Install the third-party log agent on your iSeries System.
  • Create the journal QAUDJRN and related journal receivers.
  • Set the appropriate auditing system security values.

Consult your third-party log agent documentation and the IBM Security Reference manual for information on how to perform these actions.  


Steps 

Audit IBM iSeries System security events with SEM

These system values include:

  • QAUDCTL: Auditing Control.
  • QAUDLVL: Security Auditing Level.
  • QAUDLVL2: Security Auditing Level Extensions.
  • CHGUSRAUD: Change User Audit.
  • CHGOBJAUD: Change Object Audit.
Consult the IBM Security Reference manual for more information.


Integrate third-party iSeries log agents with SEM

To integrate third-party iSeries log agents with SEM:
 

  1. Configure iSeries System auditing as described in the IBM Security Reference manual.
  2. Install and the third-party log agent on the as described in the log agent documentation
  3. Configure the syslog to the SEM appliance on port 514.
    • Confirm the port number and IP address with your security administrator.
  4. Configure SEM to use the third-party log agent in the SEM console:
    1. On the SEM toolbar, navigate to Manage > Appliances view.
    2. Select Connectors from the gear icon for your appliance. The Connector Configuration window for your appliance appears.
  5. Select the gear icon for the third-party log agent instance installed on the iSeries System, and then click New.
  6. Configure the third-party log agent in the SEM console as follows:
    1. Alias: Enter the name of the third-party log agent.
    2. Log File: Enter the directory or path from which to read. This is a location on either the local computer or SEM appliance.
    3. Output: Select the desired type of output:
      •  Alert  - sends data to only the Alert database
      •  nDepth - sends data to only the RAW database
      •  Alert and nDepth - sends data to both the Alert database and the RAW database
    4. Output, nDepth Host, and nDepth Port: Configure these options to store original log messages. Define output format, nDepth Host to be used, and which nDepth port to use. LEAVE AS DEFAULT.
    5. Click Save.
  7. In the Connectors list, click the gear icon next to the new connector (in the Status column), and then select Start.
  8. Verify the connector is working by checking for events in the SEM console Monitor view.

  
Additional logging from the AS400 (IBM i-series) 

The AS400 can send logs to additional facilities in SEM, so the AS400 connector may need to be configured to receive data that is sent to the following additional logging facilities.

This is the change that is added to the /etc/syslog-ng/syslog-ng.conf 
destination d_auth     { file( "/var/log/auth.log"     template("${UNIXTIME}000 $HOST $MSGHDR$MSG\n") template_escape(no) ); };
destination d_audit    { file( "/var/log/audit.log"    template("${UNIXTIME}000 $HOST $MSGHDR$MSG\n") template_escape(no) ); };
destination d_alert    { file( "/var/log/alert.log"    template("${UNIXTIME}000 $HOST $MSGHDR$MSG\n") template_escape(no) ); };
destination d_clock2   { file( "/var/log/clock2.log"   template("${UNIXTIME}000 $HOST $MSGHDR$MSG\n") template_escape(no) ); };

filter f_auth     { facility(auth,authpriv); };
filter f_audit    { facility(13);            };
filter f_alert    { facility(14);            };
filter f_clock2   { facility(15);            };

log { source(s_src); filter(f_auth);     destination(d_auth);     };
log { source(s_src); filter(f_audit);    destination(d_audit);    };
log { source(s_src); filter(f_alert);    destination(d_alert);    };
log { source(s_src); filter(f_clock2);   destination(d_clock2);   };


Then, set up the AS400 (Agentlog) to look for auth.log, audit.log, alert.log, syslog.log, and clock2.log.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.