iSeries / IBM i System Admin Topics

We can do everything to consolidate our servers

Wednesday, January 4, 2012

Installing RSYNC on iSeries / AS400

Everday im digging more and more about iSeries PASE, my ydill with iSeries get better… and also with the Unix world.

Once i tested the syslog tool from PASE, i started wondering how it could be posible to monitor logs data on real-time. A FTP based solution seems complicated and a RPG/Sockect application is out of my skills. SYSLOG is good to handle system logs, but i need something more robust and i dont want to change programs to move logs over SYSLOG.

But i found RSYNC!.

Rsync  is a tool that synchronizes files and directories in local or in remote server. If the file doesnt exist in a new folder or remote server, RSYNC will create it. If the file exists, RSYNC will send only the differences. That seems perfect for send logs over the network and get a mirror sending only the last entries in the files. This has been in use for a long time in UNIX-like systems and Windows, so it´s time to use it in AS400 iSeries!.

 
In my enviroment i have 4 IBM i servers running telnet, ftp and webserver services. Several flat files are generated daily from Apache, TSM and ODBC sessions (Exit Points). I want to send all this data to SPLUNK (or your favourite software to analize data) and indexing for audit. monitor or perfomance analysis. And I really need to know what´s going on in my web server in real time.

 
First thing we can find about rsync and AS400 is a ibm link telling to us that rsync doesnt come in the IBM iSeries PASE Enviroment, but it sends us to Youngiprofessionals to get ideas about how to install it.

Thanks to the amazing work of Tony „Ranger“ Cairns, we have a great tutorial in youngiprofesionalls  about how to install pre-compiled Open Source binaries coming from the AIX Toolbox for Linux Applications.This is really amazing...imagine to have all the power of Linux applications on IBM i!.

Follow the steps of Tony, install RPM (you will need RPM to install all binaries in IBM i PASE) and wget. If you have proxy or it doesnt work WGET, just download the applications from here.

 
Once you have RPM installed, try to run the wwwinstall.sh command, if this doesnt work, see below.

Installing RSYCN.

ftp myIseries
bin
cd /QOpenSys/opt
put rsync*

And now, we just need to install:

STRQSH
cd /QOpenSys/opt
rpm --ignoreos --ignorearch --nodeps --replacepkgs –hUv rsync-xxx.ppc.rpm (your rsync version)

test if RSYNC is installed, just run rsync –h

Running and testing RSYNC.

Rsync can run as a daemon or as a submit job. There is several manuals out there to check how to use it. If it works for Unix or Linux, will work for IBM i!.
But for testing, if you want to synchronize 2 folders in AS400:

rsync -avz  /Myfolder1  /Myfolder2.
sending incremental file list                                 
Logs/ACCESS.LOG                                               
 Logs/ERROR.LOG                                                 
 Logs/STATS.LOG                                                
                                                               
 sent 68448 bytes  received 73 bytes  137042.00 bytes/sec      
 total size is 862256  speedup is 12.58 

if i try again the same command:             
sent 109 bytes  received 13 bytes  244.00 bytes/sec 

You can schedule this command in IBM i or configure a daemon.  With this tool, it´s posible to replicate everything from PASE.
 

Monday, January 2, 2012

Monitoring ODBC and FTP Login entries to SYSLOG

Now that Syslog in IBM i is working and sending data to a remote server, i think i will use for auditing ODBC and FTP entries on my system.

I have already a FTP Server Request Validation exit point to control what the ftp users can do on my server, but it´s writing a lot of data into a database log. For auditing reason im just interested in audit the logon for users coming in FTP and ODBC server. Basically, using Exit Points programs, you can send whatever you need to SYSLOG: telnet sessions, audit change of users profiles, BRMS logs, etc.

I made a basic CL program based n TCPL0100 parameters that send messages to the syslog daemon when a user login into FTP. Using the PASE command "logger",  i just send:

STRQSH CMD('/QOpenSys/bin/logger -p 5 -t FTPSERVER message_text)

result in the file /var/adm/messages:

 Jan  2 12:19:38 my-AS400 user:notice FTPSERVER: Login by user: JOHN

and in the remote server i got:

Jan  2 12:19:38 splunk-server user:notice Message forwarded from my-AS400: FTPSERVER: Login by user: JOHN

The parameter "p" setup the level of the log that could be:

0 Emergency: system is unusable
1 Alert: action must be taken immediately
2 Critical: critical conditions
3 Error: error conditions
4 Warning: warning conditions
5 Notice: normal but significant condition
6 Informational: informational messages
7 Debug: debug-level messages