topic Re: Monitoring logged users in Security

Monitoring logged users

janfabo — Tue, 09 Apr 2013 21:01:33 GMT

Hello,

I want to have a dashboard, where would be all my systems with users currently logged in and their IP addresses based on audit.log from linuxes and eventlog from windowses. Is there a plugin solving this?

Thank you.

Re: Monitoring logged users

piebob — Wed, 10 Apr 2013 00:20:12 GMT

hi Janfabo:

this is actually a core use case for Splunk. before you begin looking for 'plugins' (we call them apps and add-ons), i recommend you go through the tutorial from the beginning. it will explain how to upload data to Splunk, how to search it, and how to build some simple dashboards. then you will have a better idea of where to start:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/WelcometotheSplunkTutorial

Re: Monitoring logged users

yongly — Wed, 10 Apr 2013 05:45:42 GMT

I don't know if there is an app already for this, but if you're just going to go off logs that tell you when people log on and log off, then you will need to maintain a state machine using lookups. I was pointed to this a while back and found it useful:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

This would require a good understanding of the right logs and events to parse through to find the information you want..

Alternatively, you could set up a script to run when a user logs on/logs off that writes their username/IP address to a file.. which you can then Splunk. That's a bit of a hack though.