This is a tech preview feature

The Syslog record used is a JSON-formatted data object, containing information aggregated from several sources related to the transaction.When used, a Syslog record will be sent to an external APM (or any other Syslog server) for each gateway transaction.

The feature requires DataPower FW 7.6+.

Value to Customers

This feature allows customers to easily display gateway information on their APMs or log aggregators such as IBM APM, Splunk or ELK. This isolates the customer from changes to DataPower's log structure and saves the need to parse Syslog records.
Customers may link from the displayed transaction in their APM to DPOD's transaction details, in order to enhance troubleshooting efforts.
DPOD customers can use this feature to externalize DPOD information for data warehouse purposes.
DPOD customers can retain only the summarized transaction details instead of all log records. This will increase history retention time period and minimize storage requirements.

Transaction Record Structure

The following table describes the fields that are logged with this feature.

Field Name	Description	Possible Values
deviceName	DataPower gateway name	String
domainName	DataPower domain name where the transaction was executed	String
latencyElapsed	The elapsed time of the transaction in milliseconds	long
microSecTimestamp	Timestamp format of the time the transaction started	String
microSecTimestampStart	For internal use	String
microSecTimestampFinish	For internal use	String
serviceType	Service type as defined in the gateway	String - mpgw,wsp,xml-firewall,b2bgw
serviceUri	Request URI	String
serviceUrl	Request URL	String
srcNodeName	The name of the DPOD node that captured the transaction	String
isError	Indication whether the transaction completed with errors	Boolean true/false
isTechnicalError	Indication whether the transaction completed with errors	Boolean true/false
clientIp	The client IP of the machine (or load balancer) where the transaction started.	String
serviceName	The service the transaction ran on.	String
transactionId	DataPower transaction ID (TID)	String
transactionGlobalId	DataPower global transaction ID (GTID)	26 chars long
timeZone	The time zone used to log transaction start	String format +ZZ:ZZ
docAddedTimeInMil	For internal use	long
timeInMil	Transaction start time since Epoch in milliseconds	long number
timeHHMMSS	Full time of transaction start	String format HHMMSS where: HH: 00-23 MM: 00-59 SS: 00-59
requestSize	The request size	long
aggRecordVersion	Estimated FW version of the gateway that executed the transaction. (For internal use)	String

JSON Example

{
  "_index": "[logical-tran-compact_i3][0]",
  "_type": "wdpLogicalTransChild",
  "_id": "ea5ae3c55b45be5500056a13_348659",
  "_timestamp": "2018-07-11T08:22:45.457Z",
  "_version": 5,
  "_operation": "INDEX",
  "_source": {
    "deviceName": "1cb3a54303a9",
    "domainName": "Infra_Domain",
    "latencyElapsed": 2,
    "microSecTimestamp": "2018-07-11T11:22:45.313729+03:00",
    "microSecTimestampStart": "2018-07-11T11:22:45.313729+03:00",
    "microSecTimestampFinish": "2018-07-11T11:22:45.315558+03:00",
    "serviceType": "xmlfirewall",
    "serviceUri": "/UpdateWantedMenProfiles_WHSW/Service.asmx",
    "serviceUrl": "http://Infra.HA:2555/UpdateWantedMenProfiles_WHSW/Service.asmx",
    "srcNodeName": "NODE0",
    "isError": false,
    "isTechnicalError": false,
    "clientIp": "172.77.77.5",
    "serviceName": "WSS_Loopback.XMLFW",
    "transactionId": "348659",
    "transactionGlobalId": "ea5ae3c55b45be5500056a13",
    "timeZone": "+03:00",
    "docAddedTimeInMil": 1531297365329,
    "timeHHMMSS": "11:22:45",
    "timeInMil": 1531297365313,
    "aggRecordVersion": "7.6.0.0+"
  }
}

Feature enablement

For each syslog agent in the system perform the following:

Edit the file /app/flume/syslog_agents/conf/MonTier-SyslogAgent-nn/flume_syslog.conf
Change the following property to true instead of false:
MonTier-SyslogAgent-nn.sinks.syslogElasticSinknnn.serializer.enableLogicalTx = true

Stop and start Syslog agents

IBM DPOD v1.0.9.0

IBM DataPower Operations Dashboard v1.0.9.0

APM Integration

Value to Customers

Transaction Record Structure

Feature enablement

IBM DataPower Operations Dashboard (DPOD) v1.0.9.0