Splunk

ProBook 6550b

root@paardenpad:~# dpkg -i splunk-6.2.1-245427-linux-2.6-amd64.deb 

root@paardenpad:~# su splunk
splunk@paardenpad:/ /opt/splunk/bin/splunk start

• Accept license

root@paardenpad:/opt/splunk# bin/splunk enable boot-start
root@paardenpad:/var/log# usermod -a -G adm splunk

/root/scripts/copyLogs

#!/bin/bash
rsync -aze --delete --exclude='*.gz' /var/log/* /home/rijk/logs
chown -R rijk /home/rijk/logs
chmod -R 744 /home/rijk/logs

root@paardenpad:/var/www# vim /etc/crontab

• Add line

0 * * * *   root /root/scripts/copyLogs >/dev/null 2>&1

knollenpad:~ # vim /etc/crontab

• Add line

10    * * * * rsync -aze --delete -e ssh olimex:/home/rijk/logs/* /home/rijk/olimexLogs

Add logs to Splunk