Technote (troubleshooting)
Problem(Abstract)
SSH Remote collect for AIX Syslog via Syslog Host event source fails with an error : "ksh: declare: not found."
Cause
SSH collect user uses a shell other than bash
Environment
TCIM 8.5, TSIEM 2.0
Diagnosing the problem
Review the actuatorZZZ.log from the log folder, where ZZZ corresponds to the event source id of the failing event source.
The following error is reported:
<20111207 15:15:03 utc> P259M1V0.0.314.4L598A2S0E0:SshRunCommand: command line <"..\bin\maketar28.1.144-16-Syslog-AIX-linux.bat" 18.1.195|..\bin\plink.exe -ssh -2 -P 22 -batch -i .\SSHKeys\l1-tcim-key.ppk tktcim@a1-syslg "INSIGHT_SYSTEMNAME=A1-SYSLG; declare -x INSIGHT_SYSTEMNAME; rm -fr 18.1.195S.previous ; mkdir 18.1.195.start ; cd 18.1.195.start && gzip -d -c|tar -xf - && chmod +x bin/* ; mv ../18.1.195.previous ../18.1.195 ; \"bin/sshwrap28.1.144-16-Syslog-AIX-linux.sh\" 18.1.195 \"\" \"../bin/wrapgetnewrecs.sh\" \"temp195_0.tmp\" \"aix-syslog\" \"/var/spool/Tivoli/syslogs\" \"syslog-[0-9][0-9]*-[0-9][0-9]*-[0-9][0-9]*\.log\" \"18.1.195.props\" ; cd && rm -fr 18.1.195.start" 2>..\run\18.1.195.SSH.log|..\bin\sshunpack.bat>
<20111207 15:15:05 utc> P259M1V0.0.314.4L598A2S0E0:SshLogResults: ksh: declare: not found.
<20111207 15:15:05 utc> P259M1V0.0.314.4L598A2S0E0:SshLogResults:
In the above, ksh shell is being used for collection, which cannot find "declare" command.
The declare command being used by collect script is defined only on BASH shells but not on KSH shells or other shells such as POSIX.
Resolving the problem
Change the SSH collect user's shell to bash, since bash supports the 'declare' command.
The shell of the SSH user can be changed via the chsh command (Change Shell).
| Segment | Product | Component | Platform | Version | Edition |
|---|---|---|---|---|---|
| Security | Tivoli Security Information and Event Manager | Not Applicable | Linux, AIX, Windows | 2.0 | All Editions |
Rate this page:
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.