I just noticed that SiteMinder appears to be logging some detail to our IBM HTTP Server (IHS) logs, i.e.
[20/Dec/2017:13:07:37] [Information] SiteMinder Agent
SiteMinder agent is enabled.
How is this possible when we have a configured ACO to log to this file: LogFileName = /var/ibmihs/devtruecomp.aetna.comSSL/logs/webagent
The reason why this came up as well is due to the difference in log formats, which is causing some inconsistency with applications like splunk. IHS currently logs in the following format:
[Wed Dec 20 13:07:37 2017] [notice] IBM_HTTP_Server/220.127.116.11 (Unix) configured -- resuming normal operations
Release: SOASMU99000-12.5-SOA Security Manager-Upgrade
The recommended step is to reduce apache agent logging level to suppress redundant semaphore message from logging in error.log, step are documented below:
"Restrict IPC Semaphore-Related Message Output to the Apache Error Log ...
Example: Define the nete.stderr.loglevel parameter in trace.conf
In the following snippet from trace.conf, the nete.stderr.loglevel parameter is configured to restrict the Web Agent to log only IPC semaphore-related error messages to the Apache error log:
# CA Web Agent IPC logging levels
Check if this setting is the same in the environment. Also, see how the documentation details how the logs are configured to work with each other.