Collecting IFS Log Files - ironstream_for_elastic - ironstream_for_kafka - ironstream_for_splunk - 7.4

Ironstream for Splunk®/Kafka®/Elastic® for IBM i Ironstream Integration Components Administration

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Splunk®
Version
7.4
Language
English
Product name
Ironstream Splunk®/Kafka®/Elastic®
Title
Ironstream for Splunk®/Kafka®/Elastic® for IBM i Ironstream Integration Components Administration
Copyright
2022
First publish date
2007
Last updated
2023-08-25
Published on
2023-08-28T08:26:48.055356

Follow the steps to collect the IFS Log Files that are being journaled with the Configuration Tool:

  1. Create a Journal Monitor.

  2. Specify the Object Type as *STMF Type.

Note: The Raw option will be checked automatically when you choose *STMF.

  1. In the Path name field specify the path to the IFS logs you want to collect. The restrictions are as follows:

    1. It MUST start with a forward slash ‘/’.

    2. It MUST include the full path to the folder where the logs are stored.

Note: Do not use wildcards in the folder text.

  1. The name of the log file can include wildcards. Use a ‘*’ to collect all the log files in the folder or add a wildcard to the name to collect some of the log files in the folder.

For example, you can use: /home/users/*, /home/users/log*, or

/home/users/log.text.

  1. Fill in the rest of the Journal Monitor details as required, see "Choose Journals to Monitor" section for more details on other fields.

  2. Fill in the Assigned systems field to assign the completed Journal Monitor Group to one or more IBM i LPARs.

  3. Click the Save button.

  4. Click the Distribute button for the new Journal Monitor Group, to send the details to the Ironstream Agent for IBM i for the Assigned systems.

  5. On the Systems tab restart each System that is in the Assigned systems list of the newly created Journal Monitor Group.

Note: After creating or changing a journal monitor, you MUST restart each System affected by the changes to ensure that the Proxy Server is using the new configuration details when processing journal entries.

Only IFS Log records from files that meet the Journal Monitor options are sent to the Ironstream Proxy Server. These records are always sent as "raw" unformatted records. Then, Ironstream Proxy Server processes these raw records and creates JSON formatted records to send them to the destination.

Figure 13: Add the IFS Log File monitor

For further details of the fields, see "Table 2: Fields of a Journal Monitor definition" on page 21.

Note: Only ACSII and UTF-8 encodings are supported in this version.