Architecture and Data Flow - ironstream_for_splunk - ironstream_for_elastic - ironstream_for_kafka - Ironstream_Hub - 1.3

Ironstream data flows from an agent, through Hub, to an external Target.

There are two flavors of Ironstream agent:

• Ironstream Agent for IBM Z (z/OS)
• Ironstream Agent for IBM i

An Ironstream agent will need to be installed on each LPAR that you want to monitor.

Hub:

• Runs as a service on a Windows or Linux system.
• Can receive information from multiple agents.
• Has a browser-based Portal for configuring source-to-target pipelines.

  Events and performance data that are forwarded from agents to the Hub can be sent to Targets using these mechanisms:

  • File – this can be monitored by third-party tools like a Splunk forwarder or a Logstash.
    Note: When writing to file, take all necessary precautions to ensure that this data is protected. This includes ensuring that access control is applied to the machine hosting the file.
  • HTTP[S] - data can be sent to an HTTP or HTTPS end point such as Splunk’s ‘raw’ endpoint, Datadog, BigPanda, and more.
  • Generic TCP/IP – for direct syslog connections and others.