Multiple destinations for mainframe event monitoring

• US 8,738,768 B2
• Filed: 04/02/2012
• Issued: 05/27/2014
• Est. Priority Date: 03/31/2011
• Status: Active Grant

• Current Assignee: MEAS LLC
• Original Assignee: MEAS LLC
• Inventors: Fake, Robert, Gannaway, Deborah
• Primary Examiner(s): WON, MICHAEL YOUNG
• Application Number:
  US13/437,631
• Publication Number:
  US 20120254313A1
• Time in Patent Office: 785 Days
• Field of Search: 709/224, 709/238, 709/246
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3068 where the reporting involves data format conversion
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

Methods, systems, and devices are described for managing mainframe events. In the methods, systems, and devices of the present disclosure, at least one mainframe event is received at a mainframe event server module communicatively coupled with a mainframe. The received at least one mainframe event may be converted to an open format. A destination Security Information and Event Management (SIEM) application may be selected for the received at least one mainframe event based on a set of rules, and a format associated with the selected destination SIEM application may be identified. The at least one mainframe event may then be transmitted in the identified format from the mainframe event server module to the selected destination SIEM application.

Claims

1. A method for managing mainframe events, comprising:

receiving at least one mainframe event at a mainframe event server module communicatively coupled with a mainframe, wherein the received mainframe events comprise mainframe events detected from at least one system management facility (SMF) log file associated with the mainframe and filtered according to at least one predetermined filtering criterion;

converting the received at least one mainframe event to an open format;

selecting a destination Security Information and Event Management (SIEM) application for the received at least one mainframe event based on a set of rules;

identifying a format associated with the selected destination SIEM application; and

transmitting the at least one mainframe event in the identified format from the mainframe event server module to the selected destination SIEM application.

2. The method of claim 1, further comprising:

converting the received at least one mainframe event from the open format to the identified format associated with the selected destination SIEM application.

3. The method of claim 1, further comprising:

determining a content of the at least one mainframe event;

wherein the selecting the destination SIEM application is based at least partly on the content of the at least one mainframe event.

4. The method of claim 1, further comprising:

determining a type of the at least one mainframe event;

wherein the selecting the destination SIEM application is based at least partly on the type of the at least one mainframe event.

5. The method of claim 1, wherein the transmitting the at least one mainframe event to the selected destination SIEM application comprises:

writing the at least one mainframe event to a text file associated with the selected destination SIEM application.

6. The method of claim 1, wherein the transmitting the at least one mainframe event to the selected destination SIEM application comprises:

writing the at least one mainframe event to a syslog daemon associated with the selected destination SIEM application.

7. The method of claim 1, wherein the transmitting the at least one mainframe event to the selected destination SIEM application comprises:

writing the at least one mainframe event to a relational data store associated with the selected destination SIEM application.

8. The method of claim 1, wherein the mainframe events received at the mainframe event server module comprise mainframe events detected from a management console of the mainframe.

9. The method of claim 1, wherein the open format comprises Common Event Format (CEF).

10. A mainframe event server system, comprising:

a reformatting module configured to receive at least one mainframe event associated with a mainframe and convert the received at least one mainframe event to an open format, wherein the received mainframe events comprise mainframe events detected from at least one system management facility (SMF) log file associated with the mainframe and filtered according to at least one predetermined filtering criterion;

a destination selection module configured to select a destination Security Information and Event Management (SIEM) application for the received at least one mainframe event based on a set of rules and identify a format associated with the selected destination SIEM application; and

a routing module configured to transmit the at least one mainframe event in the identified format from the mainframe event server module to the selected destination SIEM application.

11. The system of claim 10, wherein the reformatting module is further configured to:

convert the received at least one mainframe event from the open format to the identified format associated with the selected destination SIEM application.

12. The system of claim 10, wherein the destination selection module is further configured to:

determine a content of the at least one mainframe event;

wherein the selecting the destination SIEM application is based at least partly on the content of the at least one mainframe event.

13. The system of claim 10, wherein the destination selection module is further configured to:

determine a type of the at least one mainframe event;

wherein the selecting the destination SIEM application is based at least partly on the type of the at least one mainframe event.

14. The system of claim 10, wherein the routing module is further configured to:

write the at least one mainframe event to a text file associated with the selected destination SIEM application.

15. The system of claim 10, wherein the routing module is further configured to:

write the at least one mainframe event to a syslog daemon associated with the selected destination SIEM application.

16. The system of claim 10, wherein the routing module is further configured to:

write the at least one mainframe event to a relational data store associated with the selected destination SIEM application.

17. A mainframe event server system, the system comprising:

at least one processor;

at least one memory communicatively coupled with the at least one processor, the at least one memory comprising executable code that, when executed by the at least one processor, causes the at least one processor to;

receive at least one mainframe event associated with a mainframe, wherein the received mainframe events comprise mainframe events detected from at least one system management facility (SMF) log file associated with the mainframe and filtered according to at least one predetermined filtering criterion;

convert the received at least one mainframe event to an open format;

select a destination Security Information and Event Management (SIEM) application for the received at least one mainframe event based on a set of rules;

identify a format associated with the selected destination SIEM application; and

transmit the at least one mainframe event in the identified format from the mainframe event server module to the selected destination SIEM application.

18. The system of claim 17, wherein the executable code further causes the at least one processor to:

convert the received at least one mainframe event from the open format to the identified format associated with the selected destination SIEM application.

19. The system of claim 17, wherein the executable code further causes the at least one processor to:

determine a content of the at least one mainframe event;

wherein the selecting the destination SIEM application is based at least partly on the content of the at least one mainframe event.