XMA: How to change old SYSLOGQ entries after updating a SIEM IP address.

XMA: How to change old SYSLOGQ entries after updating a SIEM IP address.

The cleanup commands would remove the data, but to avoid that the customer can use a SQLCI query to update the IP Address in the database itself so all the messages would then be sent to the new IP.
 
It is recommend to run the query below while XMA is down to minimize impact and keep from generating a table lock. 
 
Navigate to the XMA database subvolume (XMADAT) and enter SQLCI.
Use this command to perform the update:

Syntax: UPDATE SYSLOGQ SET TARGET_HOST = '<new host IP>' WHERE TARGET_HOST = '<old host IP>' AND CAST(ALERTEDGMT AS DATE) < DATE ?2018-01-01?;
Example: UPDATE SYSLOGQ SET TARGET_HOST = '10.1.1.21' WHERE TARGET_HOST = '10.1.1.20' AND CAST(ALERTEDGMT AS DATE) < DATE ?2018-01-01?;

If a customer does not care about keeping the any data in the SYSLOGQ table use the followin they can use a cleanup command.
To manually cleanup the Syslog queue:
  1. Stop your XMA pathway.
  2. Enter RUN XMA INSTALL (to attach the XMA segment).
  3. Use XMA_MANAGER to enter into the XYGATEMA Management Main Menu.
  4. Select 3 to navigate to the Database Management Menu.
  5. Select 14 to manually cleanup the Syslog Queue.
  6. Follow the prompts to determine what to delete.
Or they can wait until the Syslog Queue is automatically cleaned up. Selecting 15 from the Database Management Menu will show them how long the messages are retained.  

If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.

    • Related Articles

    • XMA: How to Change IP Address of the syslog server using SYSLOGQ

      To change the SIEM IP address use the following to change the IP address in the records stuck in the SySLOGQ table , and update the FILTERS file for future records. TACL> VOLUME $<VOLUME>.<XYGATEMA Installation Subvolume> TACL> RUN XMA INSTALL TACL> ...

    • XMA: Updating INSTALL.IPADDRESS

      The reported IP address is populated during install of XMA and needs to be changed manually if XMA is not being re-installed 1) Attach the XMA segment and run the XMA_DBVOLUME command 2) Enter SQLCI 3) Run the following query to change the IP ...

    • XMA: Send XMA messages to SIEM via HPE SSL proxy

      Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

    • XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

      To send Syslog messages to 2 SIEM, it's required to have two ACTION having each one set with one of the SIEM IP Address. ACTIONCOLL_BEGIN ACTION_BEGIN ACTIONTYPE IPALERT ! SYSLOGQ .... IPALERT_ADDRESS <IP Address-A> .... ACTION_END ACTION_BEGIN ...

    • XMA: Can XMA movers send data off-box to a SIEM?

      Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...