Splunk Implementations in Higher Ed

I brought up Splunk almost four years ago after exposure to the product in a growing (at the time) start-up environment.  My initial goal was to to address the gaping holes in our change management process as it related to config changes to firewall policies and core network equipment -- what was done, when and by whom.  That expanded to alerting on "bad things" -- restarts, network loops, memory errors, etc. -- on all net equipment.  Bringing server data into the fold only added more fun and adding web and application logs provided accurate data not only for focus on security but troubleshooting and planning for system expansion (or not).

Need to locate that missing/lost/stolen iPad?  Notebook has become part of a botnet?  Performance hit on your VMware cluster?  Have some pesky Exchange issue?  Forward the logs, install the appropriate app/dashboard (or just search the raw data), and see what's really going on.  It's Google for your logs and I really can't get enough.  Low profile clients, scalable architecture, reasonably priced, community supported, and darn fast searching.  Yeah, I'll be a fanboy.

- Pat

Patrick N. Gorsuch Manager, Networks and Information Security Gallaudet University 202-651-5070 patrick.gorsuch@gallaudet.edu On 8/1/2012 9:51 AM, Martin Manjak wrote: