Adding Quest SharePlex via Syslog

Overview

Quest SharePlex is a database replication product for Oracle and other databases. SharePlex records process starts and stops, operator commands, connection events, license warnings and replication errors in a plain text file called the event log. This article explains how to forward the SharePlex event log to Logsign Unified SecOps Platform via syslog and what Logsign extracts from each line.

SharePlex does not send syslog by itself. The event log is a local file, so a log forwarder on the SharePlex server (rsyslog in the example below) reads the file and relays each new line to the Logsign syslog collector. This is a syslog-based, parser-only integration. There is no API poller or credential to configure on the Logsign side.

Prerequisites

• A Logsign Unified SecOps Platform release that includes the Quest SharePlex parser. If Quest is not listed as a vendor in the Add Device screen, contact Logsign Support to confirm your version.
• SharePlex running on a Linux or Unix server. The example below uses rsyslog, which ships with most Linux distributions. For SharePlex on Windows, use a file-to-syslog agent of your choice; the Windows setup was not verified for this article.
• Root (or sudo) access on the SharePlex server to edit the rsyslog configuration.
• Network access from the SharePlex server to the Logsign syslog collector on the syslog port you use (514 by default).

Locate the SharePlex Event Log

SharePlex writes the event log to the log subdirectory of its variable-data directory. The path is $SP_SYS_VARDIR/log/event_log. Run the command below as the SharePlex administrator user to see the directory for your instance:

echo $SP_SYS_VARDIR

If the server runs more than one SharePlex instance (one per port), each instance has its own variable-data directory and its own event_log file. Forward each file separately.

The same directory also holds per-process logs and trace logs. These are meant for Quest Support troubleshooting and are not parsed by Logsign. Forward only event_log.

Configure rsyslog on the SharePlex Server

Create a file such as /etc/rsyslog.d/60-shareplex.conf with the content below. Replace the file path with your $SP_SYS_VARDIR value and <LOGSIGN_IP> with the IP address of your Logsign syslog collector.

module(load="imfile")
input(type="imfile"
      File="/u01/splex/var/log/event_log"
      Tag="shareplex:"
      Severity="info"
      Facility="local5"
      startmsg.regex="^(Info|Notice|Warning|Error|Fatal) [0-9]{4}-")
local5.* action(type="omfwd" target="<LOGSIGN_IP>" port="514" protocol="tcp"
                template="RSYSLOG_SyslogProtocol23Format")
& stop

A few notes on this configuration:

• startmsg.regex tells rsyslog that every SharePlex event starts with a level word and a date. A continuation line that has no level word is attached to the event above it instead of being sent as a separate, unparseable message.
• The local5 facility is only an example. Pick any free facility from local0 to local7 if local5 is already in use on the server.
• For a second SharePlex instance, add another input block with its own File path and Tag.
• Both RFC 5424 (as in the example) and the traditional RFC 3164 syslog header are accepted, so the default rsyslog forwarding template also works. UDP can be used instead of TCP; TCP is recommended because it does not silently drop messages.

Restart rsyslog to apply the change:

systemctl restart rsyslog

Add Device in Logsign USO

Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select Quest as the vendor and SharePlex as the product.

Click Save to add the source. Events should appear under Search once rsyslog starts relaying new event log lines.

Log Format

Each SharePlex event log line has the layout below. The session number and the trailing module name appear only on some lines.

<Level> <YYYY-MM-DD> <HH:MM:SS.microseconds> <pid> <thread> [s:<session>] <message> [module <name>]

Sample lines (taken from public Quest knowledge base articles):

Notice 2008-10-31 23:28:50.199158 5337538 1 User command: oracle activate config config_Abc.file (from s12cdc.cdc.abc.com)
Info     2011-01-14 19:11:20.075846 27948 1 Poster launched, pid = 27148  (posting from SID1, queue queue_name, to SID2)
Error    2018-03-27 16:51:44.601373 29814 1114429760 Capture: [SP-OCT01511] Unable to find archivelog with sequence#: 77041 (thread: 1).   See 'http://advice.shareplex.com/SP-OCT01151' for additional advice and support.   (capturing from o.ORA15GR2) [module oct]

The level word must be one of Info, Notice, Warning, Error or Fatal, and the time must include fractional seconds. Lines that do not follow this layout are not parsed as SharePlex events.

Supported Events

Logsign classifies each line by its message text. The first matching rule wins. Lines that match none of the specific rules are still parsed and kept as general operation events.

The Event System ID is the prefix ID 4528 followed by the Event Vendor ID (for example 45281 for a user command).

Severity

Severity comes from the SharePlex level word: Info becomes information, Notice becomes notice, Warning becomes warning, Error becomes error and Fatal becomes critical. One exception applies: a process that exits with a non-zero code is always reported with error severity, even though SharePlex logs it at Info level.

Extracted Fields

Every event also carries Vendor Quest, Product SharePlex, Category Data Replication, Type Database Server and prefix ID 4528.

Notes and Limits

• Only the SharePlex event log format is parsed. Per-process logs, trace logs and other files from the same directory are not matched by this parser.
• SharePlex can truncate its own event log (for example with the truncate log command in sp_ctrl). rsyslog continues to follow the file after truncation. Whether lines written at the moment of truncation can be lost was not verified.
• Very long event lines can be cut by the forwarder's maximum message size (rsyslog default 8 KB). A cut line may lose its trailing context and module name.

Verification

• Confirm that the source receives data under Settings > Data Collection (the event count increases).
• Search for the device name and check that events show Vendor Quest, Product SharePlex, and fields such as Process Name, Event Info and Severity.