Collecting System Audit Journal (QAUDJRN) Data - ironstream_for_elastic - ironstream_for_kafka - ironstream_for_splunk - 7.4

1. Launch the Configuration Tool.

2. Select the Journal Monitors tab.

3. Choose an existing journal monitor group if one has already been created, or create a new group using the Create button. Choose a name for the monitor group.

4. Enter a Frequency interval (in seconds) to select how often the journal is polled for new entries. Use increments of 30 seconds.

5. On the Journal Monitor Group page, click Add Monitor to add the system audit journal.

6. In the configuration screen, enter QAUDJRN in the Journal Name field and QSYS in the Journal Library field.

7. Ensure Raw is checked.

8. The Field Description Config selection should be left blank and is ignored when Raw is selected.

Figure 11: Add the System Audit Journal

9. To send all supported entry types:

   • Enter T for the Entry Code.

   • Do not add individual entry types.

10. To send only selected journal entry types:

    • Leave the Entry Code empty.

    • Click the Add Type button to add an entry type.

11. To add additional entry types, continue clicking the Add Type button.

Figure 12: Add Specific Journal Entry Types

12. Fill in the Assigned systems field to assign the completed Journal Monitor Group to one or more IBM i LPARs.

13. Click the Save button.

14. Click the Distribute button to send the monitor group to the Ironstream Agent for IBM i for the

Assigned systems.

15. On the Systems tab restart each System that is in the Assigned systems list of the newly created Journal Monitor Group.