My 2nd Head

Yeaah!!! Just found out that Splunk 3.0 will support access control. This means e.g., that developers can debug production problems without logging in to that host. They will see only logfiles relevant to finding the problem... This is a huge step forward, as logs often contain classified data.

As a system administrator, there is one problem that is persistent. Standardizing and keeping track of configuration changes. Standardizing begins with the installation of a system. All major unix brands have their own installation methods. As mainly a Solaris administrator, I'm very familiar with the Jumpstart framework. Using plain vanilla jumpstart is ok, if no customization in addition to the OS is needed (special configurations/application installation) For advanced customization, Sun Professional Services UK developed the JET framework. JET is an addition to Jumpstart. The advantage of JET is in its usage of template files. All information about a client to install is kept in one file. The framework provides a simple way to add additional software, make additional software changes. With JET it is possible to get a host running with all its settings and applications. But, as soon as there are changes on a specific host, which could affect standardization, those changes have t...

Since I read about Splunk on Ben Rockwood's blog , I'm a huge fan. I even got a Splunk baseball cap and a T-Shirt. At my former employer, I've implemented Splunk to collect system logs for system monitoring and compliance checks/reporting. Version 3.0 (still in beta) seems to be a huge step forwards. Reporting e.g. is now very sophisticated, allowing one to create many kinds of reports (charts, tables). To get a quick overview over different environment aspects, it is possible to create user/role dashboards. In the beginning Splunk was mainly meant for sucking only log files in, the target has now changed to index any kind of unstructured data. I'm very much interested in loading configuration files and monitor these for changes (security monitoring/audits anyone?). It is also possible to periodically index command outputs. This could be used for recording performance data (output from e.g. iostat, vmstat, etc.). The output from a config file or a command, looks just ...