DB2 (Based on Linux) integration

Discussion created by rajbir singh on Oct 19, 2019
Latest reply on Oct 30, 2019 by rajbir singh

Like • Show 0 Likes0
Comment • 5

Hello All,

We are in process to integrate DB2 with RSA netwitness 11.1. We checked the RSA integration document and found DB2 integration for windows and AIX is already supported.

Can any one help to integrate DB2 installed on Linux? we need help to enable auditing on DB2 which is installed on Linux.

I believe there would be no much difference in enabling auditing on DB2, as it would be the same for DB2 either its installed on AIX or Linux. Please correct me if i am wrong.

Also, please help with the required commands or steps to enable auditing?

Once auditing is enabled we can use sftp to collect logs files.

Thanks in advance.

Aaron Geer Aaron Thummel RSA Customer Support

Outcomes

5 Replies

Dave Glover Oct 19, 2019 12:35 PM
Rajbir

Have you looked at the following resource? IBM Knowledge Center

That should help you enable auditing. I would think the auditing format is similar to the AIX version.

First try and get the auditing configured then once you do that, reach out to me and I can help with the parsing of the data.

Thanks

Dave
Like • Show 0 Likes0
Actions
- rajbir singh @ Dave Glover on Oct 22, 2019 2:19 AM
  Dear Dave,
  
  Thank you so much for response.
  
  I am in process to enable the auditing on DB2 once it is done i will try to follow the sftp integration process. if we face any issue will post over here.
  
  Your help is really Appreciated.
  
  Thanks,
  Like • Show 0 Likes0
  Actions
  - Dave Glover @ rajbir singh on Oct 22, 2019 2:32 AM
    Great, let me know how you make out.
    
    Dave
    Like • Show 0 Likes0
    Actions
    - rajbir singh @ Dave Glover on Oct 30, 2019 2:00 PM
      Hi Dave,
      
      We are doing this integration now so apologies for delay in response.
      
      It is the same file collection integration that we use for any other supported device. Below are the steps that we are following:
      
      1. Enable the auditing on DB2 using : IBM knowledge center
      
      2. Added Event source on VLC
      
      3. Configured sasftpagent.sh and sftpagent.conf
      
      4. Required permission given to sasftpagent.sh
      
      5. cache the sftp connection.
      
      Here, we can see sftp connection can be created without prompting any password. Also when i run the script i can see (using tcpdump) DB2 logs are coming in VLC but strange thing is that these logs do not appear in investigation page.
      
      For further confirmation i check directory which we have create in process of event source creation but found logs are not even store in that directory.
      
      Can you please help me to understand where these logs are going? Why these logs are not being store or visible in investigation page.
      
      Please find the attached sasftpagent.sh and sftpagent.conf file which we are using for this integration.
      
      I have tested one another server as well and found logs are not stored in directory which was created during event source creation but logs were visible in investigation page.
      
      The only difference is, i am using "_ " in name of directory in recent integration.
      Like • Show 0 Likes0
      Actions
    - rajbir singh @ Dave Glover on Oct 30, 2019 2:02 PM
      This is the script and conf file which we are using.
      Attachments
      sasftpagent.sh37.2 KB
      sftpagent.conf.zip1.4 KB
      Like • Show 0 Likes0
      Actions

DB2 (Based on Linux) integration

Outcomes

Attachments

Related Content

Recommended Content