The syslog-ng Administrator Guide

System audit journal: The system audit journal QAUDJRN can be configured to capture a large number of security and system management events. The syslog-ng Agent for IBM System i application can capture the entries in the QAUDJRN journal in real time, format them to syslog or CEF format, and send them to a syslog server. The syslog server can be running on the System i or any remote server. The IBM System i Security Reference Manual provides information on how to change system values, user profiles, and objects to capture various system change and security events.

System i operator messages: The system operator message queue QSYSOPR receives application and system messages. The syslog-ng Agent for IBM System i application can capture the messages in the QSYSOPR message queue, format them to the syslog or CEF standard, and send them to a syslog server. The syslog server can be running on the System i or any remote server.

User-generated logs: The syslog-ng Agent for IBM System i application provides command and API interfaces to allow a user program to create syslog or CEF event records. User applications can provide simple text values for messages and specify the priority and facility ID for the message. Any user application can be enabled for syslog or CEF application messages.