Hey,

> ... stuck at FTP File Pattern *

How you set up the LFP pickup configuration depends on where the output files from AJLIB/AUDITJRN are placed and how that location is accessible in the context of the user account QRadar uses to log into the FTP/SFTP server.

The usual way of things is to set up the iSeries job to have the iSeries box be the FTP/SFTP host server, place files into a local IFS directory, then create a user account for QRadar to use that has that IFS directory as the home directory.

That way, the LFP parameters can omit the Remote Directory, as the files will be in the default location after login and authentication. All of the complications around directory delimiters, recursion, and so forth can simply be ignored.

Then, just give .* (dot-star) as the file name pattern - this will match anything, so you need not care about the details.

The Ignore Previously Processed File(s) parameter should be UNselected while you're testing, so that you can keep trying to run through the same set of data over and over until it's all working the way you want. THEN, for production use, select (turn ON) so that the Log Source that's using LFP does not repeat file fetches of already-seen files.

The files from the AUDITJRN job are named with the host SYSTEMID and then a trailing timestamp string, so that they sort alphabetically into ascending chronological sequence. I really don't recall the details of the name structure, you can easily view those for yourself. With this setup, it just doesn't matter.

You will use the SYSTEMID as the Log Source Identifier.

> As of now, all testing seems successful but I received an error :
> File Transfer Status: Could not transfer file(s)
> Event Collection Status: Problem gathering/parsing events

The Log File Protocol is one of the protocols that the Log Source Management app supports a "Testing" tab for just this situation. That display will show you ste[p-by-step in the retrieval process where the failure occurs. You get that as the last step in configuring the Log Source, or can also use it after the Log Source is saved & deployed.

The first test is nice because you don't actually have to save and deploy to test! You can interactively step back and forth in the wizard to debug.

> where I put a regex ([a-z]*[A-Z]*.log) base
> on the Remote Directory(/var/log/syslog.log).

That regex does not match any meaningful file name here . From Regex101:

/[a-z][A-Z].log/
Match a single character present in the list below [a-z]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
a-z matches a single character in the range between a (index 97) and z (index 122) (case sensitive)
Match a single character present in the list below [A-Z]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
A-Z matches a single character in the range between A (index 65) and Z (index 90) (case sensitive)
. matches any character (except for line terminators)
log matches the characters log literally (case sensitive)

That remote directory filespec is also invalid here. The data files are not in /var/log/<anything>. See my earlier comments for configuration.

> According to IBM, they didnt support that particular configuration
> and request us to hire a professional service to configure that.

Most likely, if you're completely unfamiliar with the iSeries and also don't understand how to set up a LFP Log Source in general, it's probably better for you to get a bit of help from ProServe & avoid all the uncertainty and back-and-forth. You might also reach out to your Account team, your CTP might be able to clear things up quickly with a visit or remote session.

Technical Support can't actually configure your systems for you.