Configure IBM QRadar as a Monitoring Sink

Host Syslog

System logs on Paragon Automation clusters are managed by rsyslog, which supports multiple output modules. Although Paragon Automation monitoring does support collecting these host system logs, you can configure rsyslog to directly forward the system log to QRadar.

To configure rsyslog to send system log-data to QRadar:

1. Log in to a Paragon Automation cluster node and type exit to access the Linux root shell.

2. Navigate to the /etc/rsyslog.d/ directory.

3. Create a .conf configuration file using the rsyslog naming convention, or modify an existing configuration file.

4. Add the following line to the configuration file.

   content_copy zoom_out_map

   *.* action(type="omfwd" target="qradar_host" port="514" protocol="tcp" resumeRetryCount="-1" queue.type="LinkedList" queue.filename="Forward1" queue.saveOnShutdown="on")

   Replace qradar_host with your QRadar host IP address or hostname.

5. Restart the rsyslogd process.

   # service rsyslog restart

   Host system logs will start streaming into QRadar.

Repeat this process on the remaining Paragon Automation cluster nodes.

Other Logs Supported by Paragon Automation

For all other types of logs (Kubernetes container log, Docker log, Audit log) supported by Paragon Automation monitoring, perform the following steps to send system data to QRadar.

1. Log in to a Paragon Automation cluster node and type configure in Paragon Shell to enter the configuration mode.

2. Enter the following commands in configuration mode.

   content_copy zoom_out_map

   root@node# set paragon monitoring sink qradar inputs ID
   root@node# set paragon monitoring sink qradar socket address QRadar_IP_address:514
   root@node# set paragon monitoring sink qradar socket mode tcp
   root@node# set paragon monitoring sink qradar socket encoding codec raw_message

   Replace ID with the ID of the log source. Retrieve the source ID using the show paragon monitoring source ? command.

   To add multiple inputs, repeat the inputs command for different IDs or specify a list of inputs.

   content_copy zoom_out_map

   root@node# set paragon monitoring sink qradar inputs [k8s_log docker_log]

3. Type commit and-quit to commit the configuration and exit configuration mode.

4. Deploy the monitoring updates.

   content_copy zoom_out_map

   root@node> request paragon deploy monitoring