How to forward Syslog or Rsyslog messages to SAP IT Operations Analytics
Abstract
This page provides information about how to forward Syslog or Rsyslog messages to SAP IT Operations Analytics (SAP ITOA). Please check in your environment if Syslog or Rsyslog daemon is in use.
The following configuration can be performed in central service (Syslog or Rsyslog server) or in desired instance (end device).
Please check this blog for further data source integrations.
SAP ITOA
Before starting with Syslog or Rsyslog configuration, SAP ITOA needs to be prepared to receive Syslog or Rsyslog streaming content.
Therefore create a new data source (bucket) in SAP ITOA, activate syslog receiver plugin, define network port & network protocol (TCP or UDP) and start the syslog receiver service.
For the following Syslog and Rsyslog configuration examples we will refer to this SAP ITOA configuration example:
| PARAMETER | VALUE |
| Hostname | itoa-adapter.company.corp |
| Network Port | 1515 |
| Network Protocol | TCP |
Syslog-ng
Please add the following configuration in the central Syslog server or desired instance (end device). Login to the instance via console (e.g. PuTTY) with an administration account (e.g. root user).
The typical location of the Syslog configuration file is /etc/syslog-ng/syslog-ng.conf. Please check the operating system documentation for further details.
| /etc/syslog-ng/syslog-ng.conf |
|
destination d_itoa { tcp(“itoa-adapter.company.corp” port(1515) time_zone(“+00:00”) ); }; log { source(src); destination(d_itoa); }; |
Further Information:
| PARAMETER | DESCRIPTION |
| d_itoa | Destination identifier |
| tcp | Network protocol |
| itoa-adapter.company.corp | IP address or host name of SAP ITOA Adapter instance |
| 1515 | Network port, SAP ITOA Adapter is listening |
| src | Source identifier (Syslog content defined in Syslog configuration file) |
Save the configuration changes and restart Syslog service.
service syslog restart
Check in SAP ITOA user interface weather Syslog messages are received.
Rsyslog
Please add the following configuration in the central Rsyslog server or desired instance (end device). Login to the instance via console (e.g. PuTTY) with an administration account (e.g. root user).
The typical location of the Rsyslog configuration file is /etc/rsyslog.conf. Please check the operating system documentation for further details.
| /etc/rsyslog.conf |
|
$PreserveFQDN on *.* @@itoa-adapter.company.corp:1515 |
Further Information:
| PARAMETER | DESCRIPTION |
| $PreserveFQDN on | Optional: Use FQDN information (instead host name) |
| *.* | Forward all information (Rsyslog content defined in Rsyslog configuration file) |
| @@ | Network protocol TCP (@ = UDP / @@ = TCP) |
| itoa-adapter.company.corp | IP address or host name of SAP ITOA Adapter instance |
| 1515 | Network port, SAP ITOA Adapter is listening |
Save the configuration changes and restart Rsyslog service.
service rsyslog restart
Check in SAP ITOA user interface weather Rsyslog messages are received.
Troubleshooting
In case of problems check the following issues:
- Please check in SAP ITOA data source (bucket) if the syslog receiver plugin is activated (check SAP ITOA administration manual for more details)
- Please check if SAP ITOA Adapter service is running. Therefore login with an user with administration authorization, via console (e.g. PuTTY) to SAP ITOA Adapter instance and execute the following command:
ps -ef | grep itoa - Please check if Syslog or Rsyslog messages are received in SAP ITOA Adapter instance (network activity). Therefore login with an user with administration authorization, via console (e.g. PuTTY) to SAP ITOA Adapter instance and execute the following command:
tcpdump -A -s 0 -i eth0 port 1515Please adjust network card configuration (eth0) to your setup.
- Use the same approach (check network activity) in source instance to check if Syslog or Rsyslog messages are forwarded to SAP ITOA Adapter
- Check the log file of SAP ITOA Adapter which is typically available in /usr/sap/itoa_adapter/logs/itoa-adapter.log
Further Information
| Content Type | Information |
| SAP Entry Page | https://www.sap.com/itoa |
| SAP Help Page | https://help.sap.com/itoa |
Thanks for sharing USPS hours USPS tracking USPS hold mail USPS change of Address