Collecting IFS Log Files - ironstream_for_splunk - ironstream_for_kafka - Ironstream_Hub - ironstream_for_elastic - 1.3

Ironstream Hub Administration

Product type
Product family
Ironstream > Ironstream Hub
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream for Splunk®
Product name
Ironstream Hub
Ironstream Hub Administration
First publish date

Follow the steps to collect the IFS Log Files that are being journaled with the Configuration Tool:

  1. Create a Journal Monitor.
  2. Specify the Object Type as *STMF Type.
    Note: The Raw option will be checked automatically when you choose *STMF.
  3. In the Path name field, specify the path to the IFS log(s) you want to collect. The restrictions are as follow:
    1. It MUST start with a forward slash ‘/’.
    2. It MUST include the full path to the folder where the logs are stored.
      Note: Do not use wildcards in the folder text.
    3. The name of the log file can include wildcards. Use a ‘*’ to collect all the log files in the folder, or add a wildcard to the name to collect some of the log files in the folder.

    For example, you can use: /home/users/*, /home/users/log*, or /home/users/log.text.

  4. Fill in the rest of the Journal Monitor details as required. For more details about other fields, see Choose Journals to Monitor section.
  5. Fill in the Assigned systems field to assign the completed Journal Monitor Group to one or more IBM i LPARs.
  6. Click the Save button.
  7. Click the Distribute button for the new Journal Monitor Group, to send the details to the Ironstream Agent for IBM i for the Assigned systems.
  8. On the Systems tab, restart each System that is in the Assigned systems list of the newly created Journal Monitor Group.

Note: After creating or changing a journal monitor, you MUST restart each Source affected by the changes to ensure that Hub is using the new configuration details when processing journal entries.

Only IFS Log records from files that meet the Journal Monitor options are sent to Hub. These records are always sent as 'raw' unformatted records. Then, Hub Server processes these raw records and creates JSON formatted records to send them to the target.

Figure 1. Add the IFS Log File monitor

For more details of the fields, see Table: Fields of a Journal Monitor definition.

Note: Only ASCII and UTF-8 encodings are supported in this version.