DanielMiessler

Use Splunk as Your Remote Syslog Server

Created/Updated: June 1, 2009

So I’ve been messing with Splunk> a bit recently, and as part of that I’ve been sending logs from iptables, snort, and apache–not to mention the other stuff that naturally lands within /var/log/messages. As you can see, the reason I’m doing this is to get a brutally powerful data view in one interface. Here I’m showing some GET…

X

I spend 5-20 hours a week devouring books, RSS feeds, podcasts, and articles about what's happening—and what's coming—in security and technology.

Then every Sunday I send the best of what I find to around 25,000 subscribers.

“Your newsletter has become my most important source of news. It is the only newsletter I will NOT delete until I have perused it to the very end”. ~ Frank Hall Green