Monitoring logged users

[janfabo]

Hello,

I want to have a dashboard, where would be all my systems with users currently logged in and their IP addresses based on audit.log from linuxes and eventlog from windowses. Is there a plugin solving this?

Thank you.

[yongly]

I don't know if there is an app already for this, but if you're just going to go off logs that tell you when people log on and log off, then you will need to maintain a state machine using lookups. I was pointed to this a while back and found it useful:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

This would require a good understanding of the right logs and events to parse through to find the information you want..

Alternatively, you could set up a script to run when a user logs on/logs off that writes their username/IP address to a file.. which you can then Splunk. That's a bit of a hack though.

[piebob]

hi Janfabo:

this is actually a core use case for Splunk. before you begin looking for 'plugins' (we call them apps and add-ons), i recommend you go through the tutorial from the beginning. it will explain how to upload data to Splunk, how to search it, and how to build some simple dashboards. then you will have a better idea of where to start:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/WelcometotheSplunkTutorial