IBM i systems handle some of the most mission-critical transactions in your organization. In the past, they operated in relative isolation, but today they’re connected to other systems across your IT infrastructure to support mission-critical business services. They’re also connected to networks or the Internet, making them vulnerable to cybersecurity threats and incidents. It’s critical that the operational and security data generated by your IBM i systems is visible in your Splunk platform for enterprise-wide analysis, but it’s difficult to capture it and make it usable for reporting. View this webinar on-demand to learn how organizations like yours are using Ironstream to forward IBM i log data to Splunk, to gain insight into operations, security and service delivery for the ultimate success of their business. We will cover: • Key use cases for IBM i log analysis • Challenges of using IBM i data in Splunk • How Ironstream and Splunk deliver key insight into IBM i operational health and security in the broader context of your enterprise

1. How to Get IBM I Security and
Operational Insights with Splunk
Ian Hartley
Product Management Director
IBM i and Splunk are registered trademarks of International Business Machines Incorporated
and Splunk Incorporated respectively in the United States, other countries, or both.

2. Housekeeping
Webcast Audio
• Today’s webcast audio is streamed through your
computer speakers.
• If you need technical assistance with the web
interface or audio, please reach out to us using
the chat window.
Questions Welcome
• Submit your questions at any time during the
presentation using the chat window.
• We will answer them during our Q&A session
following the presentation.
Recording and slides
• This webcast is being recorded. You will receive
an email following the webcast with a link to
download both the recording and the slides.
2

3. Agenda
• Demands on Today’s IT
• IBM i to Splunk Challenges
• Syncsort Ironstream® + Splunk
for Security & Operational
Insights
• Q & A
3

4. Downtime is NOT an Option
• Loses valuable time
• Costs money
• Impacts reputation
Organizations MUST be Proactive
• Get ahead of problems…to buy valuable time
• See problems BEFORE customers see them
• Trying to do more…in same or less time
Organizations NEED TO KNOW what’s happening (in real time)
• Monitoring: System health, MTTI, MTTR
• Operational Intelligence: Performance, trends, capacity, status,
prediction
• Security: User activities, privileged use, intrusion
• Compliance: Audit, policy assurance, data access/movement4
Today’s IT Must be Agile,
Available & Aware

5. Splunk: Industry-Leading Platform For Machine Data
Machine Data: Any Location, Type, Volume
Online
Services
Web
Services
Servers
Security GPS
Location
Storage
Desktops
Networks
Packaged
Applications
Custom
Apps
Messaging
Telecoms
Online
Shopping
Cart
Web
Clickstreams
Databases
Energy
Meters
Call Detail
Records
Smartphones
and Devices
RFID
On-Premises
Private
Cloud
Public
Cloud
Platform Support (Apps / API / SDKs)
Enterprise Scalability
Universal Indexing
Answer Any Question
Developer
Platform
Report &
analyze
Custom
dashboards
Monitor
& alert
Ad hoc
search
!
5

6. Challenges
IBM i Splunk
Different Data Sources
• Journals
• Message Queues
• Operational Logs
• Databases
• Custom data and logs
IBM i Data Challenges
• Complex data structures
• Unique journal entry types
• Headers
• Product sections
• Data sections
• Variable length, Self-describing
• IBM i journals in Db2®
• Marshalling IBM i
Collection Services
• Easy-to-use output
Data Volume
Previously: Low relatively volume
Today: Millions of records generated…
…and increasing!
Time Matters
• Cannot wait for scheduled offload
• Need operational insights
• Mitigate issues – prevent problems
• Visibility: status, trends, predictions
• Must have agility to respond FAST
6

7. AD - Auditing Changes
AF - Authority Failure
AU - Attribute Change
CA - Authority Changes
CD - Command String
CO - Create Object
CP - User Profile
DO - Delete Object
DS - DST Security Password Reset
EV - System Environment Variables
GS - Socket description was given to another job
JD - Change to user parameter of a job description
JS - Actions that affect jobs
KF - Key ring file Audit Journal Entry
NA - Network attribute changed Audit Journal Entry
ND - APPN directory search filter violation
NE - APPN end point filter violation
OM - Object Move Audit Journal Entry
OR - Object Restore Audit Journal Entry
OW - Object ownership changed
Data Sources for Security and Operations
PA - Program changed to adopt authority
PG - Change of an object’s primary group
PS - Profile swap
PW - Invalid password
RA - Authority change during restore
RJ - Restoring job description with user profile
specified
RO - Change of object owner during restore
RP - Restoring adopted authority program
RU - Restoring user profile authority
RZ - Changing a primary group during restore
SE - Subsystem routing entry changed
SM - Systems management changes
SO - Server security user information actions
ST - Use of service tools
SV - System value changed
VP - Network password error
X0 - Network Authentication
ZC - Object accessed (change)
ZR - Object accessed (read)
✓ System Operator Message Queue
(QSYSOPR)
✓ Application Message Queues
✓ History Log (QHST)
✓ System Audit Journal
✓ System Summary Performance Data
✓ Collection Services Data
✓ Job Accounting Data
✓ Application File Journal Data
System Audit Journal
7

8. Ironstream for Splunk Data Collection from IBM i
LPAR Agent
8

9. Ironstream for Splunk Data Collection from IBM i
LPAR Agent
System Operator Message
Queue (QSYSOPR)
Application Message
Queues
History Log
(QHST)
System Audit
Journal
System Summary
Performance Data
Collection Services
Data
Job Accounting
Data
Application File
Journal Data
9

10. 10
LPAR Agent
IBM i
Ironstream for Splunk Data Collection from IBM i

11. 11
LPAR Agent
LPAR Agent
LPAR Agent
IBM i
Ironstream for Splunk Data Collection from IBM i

12. 12
LPAR Agent
LPAR Agent
LPAR Agent
IBM i
Ironstream for Splunk Data Collection from IBM i
TCP/IP
(optional TLS)
Collector

13. Splunk
13
LPAR Agent
LPAR Agent
LPAR Agent
IBM i
Ironstream for Splunk Data Collection from IBM i
Collector
Heavy Forwarder
TCP/IP
(optional TLS)

14. Splunk
14
LPAR Agent
LPAR Agent
LPAR Agent
IBM i
Ironstream for Splunk Data Collection from IBM i
Collector
Heavy Forwarder
TCP/IP
(optional TLS)

15. 15
Ironstream for Splunk Comprehensive
Filtering

16. 16
Ironstream for Splunk
✓ Easy to read text output

17. 17
Ironstream for Splunk
✓ Simple to use in standard Splunk searches
✓ Easy to read text output

18. 18
Ironstream for Splunk
✓ Simple to use in standard Splunk searches
✓ Easy to read text output
✓ Quick to produce visualizations for insights

19. Example Dashboards
• Security
• Authorization Failures
• Change Profile Events
• System Value Changes
• User Activities
• Operations
• Capacity Monitoring
• CPU Utilization
• Create/Delete objects
• Disk Performance
• Job Durations
• LPAR Performance
• Message Queue Events
• System Performance
• Employee Database Use Case19
Splunk Dashboards

20. • Login activity
• Command Usage
• Object Creation, Movement, Restoration,
Deletion
• System Value changes
• User Profile changes
• Authority failures (objects, users)
20
Security Scenarios

21. • Login activity
• Command Usage
• Object Creation, Movement, Restoration,
Deletion
• System Value changes
• User Profile changes
• Authority failures (objects, users)
21
Security Scenarios

22. • Login activity
• Command Usage
• Object Creation, Movement, Restoration,
Deletion
• System Value changes
• User Profile changes
• Authority failures (objects, users)
22
Security Scenarios

23. • Capacity metrics
• Job durations
• Disk performance
• Utilization (CPU, Job, Subsystem)
• LPAR performance
• Storage Pool activities (faults, etc.)
23
Operational Insights

24. • Capacity metrics
• Job durations
• Disk performance
• Utilization (CPU, Job, Subsystem)
• LPAR performance
• Storage Pool activities (faults, etc.)
24
Operational Insights

25. • Capacity metrics
• Job durations
• Disk performance
• Utilization (CPU, Job, Subsystem)
• LPAR performance
• Storage Pool activities (faults, etc.)
25
Operational Insights

27. Q & A
27
Further Information
www.syncsort.com/products/ironstream