Monitoring Splunk

Monitoring Approach Strategy

sbucchianeri
New Member

Hi All

I am looking for "Best Practice" type information on a Monitoring Approach Strategy. These would be things like:

  • What to log? (Windows, Linux, etc.)
  • What events to monitor?
  • What events to tune?
  • What do you do with the output?

Any help anyone can provide would be appreciated.

Thanks

Tags (1)
0 Karma

lukejadamec
Super Champion

Assuming that you are new to Splunk, but not new to computers in a Financial Services industry, then you should step back and consider your environment.

Somewhere in your organization the computers and servers you use were built and are maintained according to some form of Security/Compliance Guidelines. Those guidelines specify what you want to log, and why you want to log it.

Those are the things that you want to monitor and analyze with Splunk. You will probably find that each of those (and there are probably many) are separate topics here on Answers.

For example, when a Windows server was put into production it was preconfigured by someone at your shop to log a specific set of events, for a specific reason. We do not know that information.

kristian_kolb
Ultra Champion

+1. The question is still a bit open-ended.

What types of systems, standard applications, bespoke applications, what compliance framework (if any)...etc

0 Karma

sbucchianeri
New Member

Apologies. I am looking for a balance between Security, Compliance & Operations for the Financial Services industry. Hope that helps.

0 Karma

kristian_kolb
Ultra Champion

That would totally depend on your use cases.

Compliance? Security? Operations? Development? Billing? Business Intelligence?

Sorry, but you need to refine your question a bit before you can get any good answers.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...