Configuring the IBM i Agent - ironstream_for_splunk - Ironstream_Hub - ironstream_for_kafka - ironstream_for_elastic - 1.3

Ironstream Hub Administration

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream for Splunk®
Ironstream > Ironstream Hub
Version
1.3
Language
English
ContentType
Administration
Product name
Ironstream Hub
Title
Ironstream Hub Administration
First publish date
2022
ft:lastEdition
2024-04-15
ft:lastPublication
2024-04-15T10:44:03.897025

To instruct the IBM i agent to collect the required information, there are a number of configuration panels within the Hub. These are accessed via the pull-out menu on the left-hand side of the Pipeline page.
Once configured, each of these components can be edited, renamed, copied, or deleted by selecting the appropriate option from the summary page. For example, the image below shows the Message Queue list and the various maintenance options.

Before any of the IBM i Agents installed across your IT infrastructure can begin to capture the required information, the configuration details must be distributed to, or sent to, the relevant agents. This is done by assigning systems to each configuration element and clicking the Distribute button.

Each configuration element can be associated with one or more Systems and the EVSBS subsystem must be running on each System in order to receive the distributed configuration details.

Once the configuration details have been received, the agent will immediately begin monitoring the specified Message Queues, Message ID’s, Filters, etc.

Message Queues

IBM i messages can be captured from any message queue or the QHST message log.

To change the message queues being monitored, add a new configuration group using the Create button or edit an existing group using the Edit button.

The QSYSOPR/QSYS queue is listed by default in the “Default” group. Use the Add Message Queue button to add additional queues to a group. To delete a listed queue, click the Delete button to the right of the entry.

Message Queue Filters

Message ID Filters can be configured for message queues. They restrict the number of messages that are sent from the Ironstream Agent to the Hub.

To change the list of message IDs that are sent to Hub, add a new filter group using the Create button or edit an existing one using the Edit button.

For any list of message IDs, you need to specify whether the list relates to message IDs that should be forwarded to the Hub (Include) or ignored or not forwarded (Exclude).

You can then add any number of message ID filters by clicking the Add button.

Each filter must have no more than seven alphanumeric characters. Two wildcard characters are allowed in Message IDs so you do not have to specify every individual message ID if there is a group of similar IDs that you are looking for.
  • A period (.) can be used in a message ID as a wildcard, which indicates that any single character in that position should be considered a match.
  • If the message ID is terminated with an asterisk (*), matching will only occur on characters preceding the asterisk.
See these examples:
Table 1. Message Filter Examples (using the 'nclude' option)
To forward these messages: Enter these in the list of message IDs
All messages *
ABC1234 ABC1234
All messages beginning with 'ABC' ABC*
Any 7-character message beginning with 'ABC' and ending with '9' ABC...9

QHST Filters

Filters can be configured for the QHST message log so that the number of messages forwarded by the Ironstream Agent can be restricted to only those that you are specifically interested in.

To change the list of message IDs that are sent to Hub, add a new filter group using the Create button or edit an existing one using the Edit button.

Click the Add Filter button and enter the new message IDs to the list in the new field. To delete a message ID from the list, click the message’s Delete button.
Note: Wildcards are not supported for QHST, you must provide a 7-character message ID for each filter field you add.

Message Format

IBM i messages from a message queue or QHST will have these JSON fields:

JSON Field Names

Field Descriptions

msg_id

The 7-character message ID.

severity

The 2-character severity code (00-99).

job_name

The name of the job that generated the message.

username

The user profile that job_name is running under.

pgm_name

The name of the program that issued the message. Note that for messages from the history log (QHST), the program name will not be set.

msg_type

The message type from the message queue. The possible values are:
  • 01 – Completion
  • 02 – Diagnostic
  • 04 – Informational
  • 05 – Inquiry
  • 06 – Sender's Copy
  • 08 – Request
  • 10 – Request with prompting
  • 14 – Notify
  • 15 – Escape
  • NA – Not available

msg_text

The text of the message.

queue

The name of the message queue.