Hi to all.
If anyone interested there is slightly different approach.
I use aix syslog daemon to forward audit logs to the linux server (rsyslogd or whatever), to the specific file.
And then I parse that file by the flexconnector.
The benefit is that I do not use any additional self-developed components like perl/sh/python scripts etc.
Only standard means: aix system utils, syslog and flexconnector functionality.
Scripting is always great but if I can avoid it without loss - I try to avoid it.
I couldn't come up with anything better than a parser chain (main flex + extraprocessor).
Flexconnector logic:
1. aixaudit.sdkrfilereader parses messages from aix (which we forward to the file) and looks for ssh authentications (submessage0) and audit messages (submessage1). Audit messages go in 2 lines with definite format so I can use multiline parsing.
Sshd messages are single line so we need parameter multiline.singleline.nowaiting=True.
2. the whole audit message is turned into the string <audit class>=<message>, where audit class is AIX audit type (PROC_Create, TCPIP_config etc) and message is an audit string (something like 'audit object read event detected /etc/security/passwd').
3. that string is stored in the field flexString1 and flexString1 is parsed by the extraprocessor aixaudmsg.sdkrfilereader.
4. aixaudmsg.sdkrfilereader tries to parse all aix audit types. Big thanks to for the great job of turning aix audit documentation into the submessages. Saved a couple of hours for me .
I've tuned submessages a little for my customer: corrected some regular expressions which were originally wrong in the aix documentation and mapped useful messages to the main arcsight event schema instead of additional data.
Also I've come up with the categorization file, but It's a bit subjective. Though I believe it's a good start anyway.
Configs are attached:
aixaudit.sdkrfilereader.properties, aixaudmsg.sdkrfilereader.properties and aix.csv (goes into acp/categorizer/current/ibm).
Five month in work - so far so good.
