Collect IBM AIX system logs

Parser Version: 15.0

Supported in:

This document explains how to ingest IBM AIX system logs to Google Security Operations using Bindplane.

IBM AIX is a Unix-based operating system designed for enterprise workloads on IBM Power Systems hardware. AIX system logs contain information about system events, authentication activity, kernel messages, daemon operations, and security-related events generated by the syslog daemon.

Before you begin

Make sure you have the following prerequisites:

  • Google SecOps instance.
  • Windows Server 2016 or later, or Linux host with systemd to run the Bindplane agent.
  • Network connectivity between the Bindplane agent host and the AIX system on UDP port 514.
  • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements.
  • Root or privileged access to the AIX system.
  • IBM AIX 7.1 or later operating system.

Get Google SecOps ingestion authentication file

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Collection Agent.
  3. Click Download to download the Ingestion Authentication File.

  4. Save the file securely on the system where Bindplane agent will be installed.

Get Google SecOps customer ID

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Profile.

  3. Copy and save the Customer ID from the Organization Details section.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

  1. Open Command Prompt or PowerShell as an administrator.

  2. Run the following command:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. Wait for the installation to complete.

  4. Verify the installation by running:

    sc query observiq-otel-collector

The service should show as RUNNING.

Linux installation

  1. Open a terminal with root or sudo privileges.

  2. Run the following command:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. Wait for the installation to complete.

  4. Verify the installation by running:

    sudo systemctl status observiq-otel-collector

The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide.

Configure the Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

  • Linux:

    sudo nano /status observiq-otel-collector/config.yaml/config.yaml

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edit the configuration file

  • Replace the entire contents of config.yaml with the following configuration:

    receivers:
  udplog:
    listen_address: "0.0.0.0:514"

exporters:
  chronicle/aix_system:
    compression: gzip
    creds_file_path: '<CREDS_FILE_PATH>'
    customer_id: '<CUSTOMER_ID>'
    endpoint: <REGION_ENDPOINT>
    log_type: AIX_SYSTEM
    raw_log_field: body
    ingestion_labels:
      source: aix

service:
  pipelines:
    logs/aix_to_chronicle:
      receivers:
        - udplog
      exporters:
        - chronicle/aix_system

Configuration parameters

Replace the following placeholders:

Exporter configuration:

  • <CREDS_FILE_PATH>: Full path to ingestion authentication file:
    • Linux: /etc/bindplane-agent/ingestion-auth.json
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • <CUSTOMER_ID>: Customer ID from the previous step
  • <REGION_ENDPOINT>: Regional endpoint URL:
    • US: malachiteingestion-pa.googleapis.com
    • Europe: europe-malachiteingestion-pa.googleapis.com
    • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
    • See Regional Endpoints for complete list

Save the configuration file

After editing, save the file:

  • Linux: Press Ctrl+O, then Enter, then Ctrl+X
  • Windows: Click File > Save

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Linux:

  1. Run the following command:

    sudo systemctl restart observiq-otel-collector

  2. Verify the service is running:

    sudo systemctl status observiq-otel-collector

  3. Check logs for errors:

    sudo journalctl -u observiq-otel-collector -f

To restart the Bindplane agent in Windows:

  1. Choose one of the following options:

    • Command Prompt or PowerShell as administrator:
    net stop observiq-otel-collector && net start observiq-otel-collector
    • Services console:
      1. Press Win+R, type services.msc, and press Enter.
      2. Locate observIQ OpenTelemetry Collector.
      3. Right-click and select Restart.

  2. Verify the service is running:

    sc query observiq-otel-collector

  3. Check logs for errors:

    type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Configure syslog forwarding on AIX

  1. Sign in to the AIX system with root or privileged access.

  2. Edit the /etc/syslog.conf file using a text editor (for example, vi):

    vi /etc/syslog.conf

  3. Add the following line to forward logs to the Bindplane agent:

    *.info  @<BINDPLANE_AGENT_IP>
    • Replace <BINDPLANE_AGENT_IP> with the IP address of the Bindplane agent host.
    • The separator between the selector (*.info) and the action (@<BINDPLANE_AGENT_IP>) must be a tab character.
    • The selector *.info forwards all messages with info priority or higher from all facilities. Adjust the facility and priority as needed per your requirements.

  4. Save the file and exit the editor.

  5. Refresh the syslogd daemon to apply the changes:

    refresh -s syslogd

    stopsrc -s syslogd
startsrc -s syslogd

  6. Verify that the syslogd daemon is running:

    lssrc -s syslogd

    The output should show syslogd with a status of active.

  7. Ensure that UDP port 514 is open between the AIX host and the Bindplane agent.

Verify log forwarding

Test that logs are being forwarded to the Bindplane agent:

  1. On the AIX system, generate a test log message:

    logger -p user.info "Test syslog message from AIX"

  2. On the Bindplane agent host, check the agent logs to verify the message was received:

    Linux:

    sudo journalctl -u observiq-otel-collector -n 50

    Windows:

    type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

  3. Verify that logs appear in the Google SecOps console within 5-10 minutes.

UDM mapping table

Log Field UDM Mapping Logic
application target.application Value extracted from the message field using grok patterns.
cmddata target.process.command_line Value extracted from the message field using grok patterns.
command_line principal.process.command_line Value extracted from the description field using grok patterns.
description metadata.description Value extracted from the message field using grok patterns.
folder target.process.file.full_path Value extracted from the message field using grok patterns.
hostname principal.hostname Value extracted from the message field using grok patterns.
intermediary_hostip intermediary.ip Value extracted from the message field using grok patterns.
sc_summary security_result.summary Value extracted from the description field using grok patterns.
severity security_result.severity Set to "INFORMATIONAL" if severity is "info" (case-insensitive). Set to "ERROR" if severity is "Err" (case-insensitive).
src_ip principal.ip Value extracted from the message or description field using grok patterns.
src_port principal.port Value extracted from the description field using grok patterns.
sys_log_host intermediary.hostname Value extracted from the message field using grok patterns.
syslog_priority security_result.priority_details Value extracted from the message field using grok patterns.
ts metadata.event_timestamp Converted from the ts field in the log message using grok and date filter.
user principal.user.userid Value extracted from the message or description field using grok patterns.
N/A metadata.event_type Set to "STATUS_UPDATE" if src_ip or hostname are present. Set to "USER_UNCATEGORIZED" if user is present but not the others. Otherwise set to "GENERIC_EVENT".
N/A metadata.vendor_name Set to "AIX_SYSTEM".
N/A metadata.product_name Set to "AIX_SYSTEM".
N/A metadata.log_type Set to "AIX_SYSTEM".

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.