Re: Splunk Implementations in Higher Ed

[Patrick Gorsuch <patrick.gorsuch () GALLAUDET EDU>]

I brought up Splunk almost four years ago after exposure to the product 
in a growing (at the time) start-up environment.  My initial goal was to 
to address the gaping holes in our change management process as it 
related to config changes to firewall policies and core network 
equipment -- what was done, when and by whom.  That expanded to alerting 
on "bad things" -- restarts, network loops, memory errors, etc. -- on 
all net equipment. Bringing server data into the fold only added more 
fun and adding web and application logs provided accurate data not only 
for focus on security but troubleshooting and planning for system 
expansion (or not).

Need to locate that missing/lost/stolen iPad?  Notebook has become part 
of a botnet?  Performance hit on your VMware cluster?  Have some pesky 
Exchange issue?  Forward the logs, install the appropriate app/dashboard 
(or just search the raw data), and see what's really going on.  It's 
Google for your logs and I really can't get enough.  Low profile 
clients, scalable architecture, reasonably priced, community supported, 
and darn fast searching. Yeah, I'll be a fanboy.

- Pat

Patrick N. Gorsuch
Manager, Networks and Information Security
Gallaudet University
202-651-5070
patrick.gorsuch () gallaudet edu

On 8/1/2012 9:51 AM, Martin Manjak wrote:
> For those of you who have expressed an interest in log aggregation and
> data mining (e.g., Splunk), there is an article in the current issue of
> CIO that describes a few implementations in higher ed. (The title is
> somewhat misleading.)
>
> Can Big Data Help Universities Tackle Security, BYOD?
>
> http://www.cio.com/article/712569/Can_Big_Data_Help_Universities_Tackle_Security_BYOD_?page=1&taxonomyId=3143