Remote collect fails for 'AIX syslog via syslog host'

Technote (troubleshooting)


Problem(Abstract)

SSH Remote collect for AIX Syslog via Syslog Host event source fails with an error : "ksh: declare: not found."

Cause

SSH collect user uses a shell other than bash

Environment

TCIM 8.5, TSIEM 2.0

Diagnosing the problem

Review the actuatorZZZ.log from the log folder, where ZZZ corresponds to the event source id of the failing event source.

The following error is reported:

<20111207 15:15:03 utc> P259M1V0.0.314.4L598A2S0E0:SshRunCommand: command line <"..\bin\maketar28.1.144-16-Syslog-AIX-linux.bat" 18.1.195|..\bin\plink.exe -ssh -2 -P 22 -batch -i .\SSHKeys\l1-tcim-key.ppk tktcim@a1-syslg "INSIGHT_SYSTEMNAME=A1-SYSLG; declare -x INSIGHT_SYSTEMNAME; rm -fr 18.1.195S.previous ; mkdir 18.1.195.start ; cd 18.1.195.start && gzip -d -c|tar -xf - && chmod +x bin/* ; mv ../18.1.195.previous ../18.1.195 ; \"bin/sshwrap28.1.144-16-Syslog-AIX-linux.sh\" 18.1.195 \"\" \"../bin/wrapgetnewrecs.sh\" \"temp195_0.tmp\" \"aix-syslog\" \"/var/spool/Tivoli/syslogs\" \"syslog-[0-9][0-9]*-[0-9][0-9]*-[0-9][0-9]*\.log\" \"18.1.195.props\" ; cd && rm -fr 18.1.195.start" 2>..\run\18.1.195.SSH.log|..\bin\sshunpack.bat>
<20111207 15:15:05 utc> P259M1V0.0.314.4L598A2S0E0:SshLogResults: ksh: declare: not found.
<20111207 15:15:05 utc> P259M1V0.0.314.4L598A2S0E0:SshLogResults:

In the above, ksh shell is being used for collection, which cannot find "declare" command.

The declare command being used by collect script is defined only on BASH shells but not on KSH shells or other shells such as POSIX.

Resolving the problem

Change the SSH collect user's shell to bash, since bash supports the 'declare' command.


The shell of the SSH user can be changed via the chsh command (Change Shell).


Cross reference information
Segment Product Component Platform Version Edition
Security Tivoli Security Information and Event Manager Not Applicable Linux, AIX, Windows 2.0 All Editions

Rate this page:

(0 users)Average rating

Document information


More support for:

Tivoli Compliance Insight Manager
Actuator /Agent

Software version:

8.5

Operating system(s):

Windows

Software edition:

All Editions

Reference #:

1621226

Modified date:

2012-12-30

Translate my page

Machine Translation

Content navigation