Skip to main content
Lantern Home

 

Splunk Lantern

Linux and Unix

  1. Last updated
  2. Save as PDF

Linux is a widely adopted open-source operating system known for its flexibility, security, and robust performance across various computing environments. Its open-source nature allows for extensive customization and a vibrant community, making it a foundational component for servers, embedded systems, and development workstations.

Before looking at documentation for specific data sources, review the Splunk Help information on general data ingestion for Splunk Enterprise, Splunk Cloud Platform or Splunk Observability Cloud.

Getting data in

Source Add-ons and Apps Guidance

Linux and Unix

Similar to other operating systems, there are different types of logs can you get from Linux.

  • Security logs. Linux security logs are a source of data that records information related to login attempts (success and failure), elevated privileges, and other security events as defined by the system’s audit policy. These logs are one of the primary tools used by security analysts to detect and investigate unauthorized activity and to troubleshoot access problems.
  • Operating logs. Linux operating system logs are a source of data that reports on state changes in a UNIX or Linux variant operating system. This includes changes to applications, service state, and hardware events. These events are used by operations and development teams to troubleshoot and mitigate errors.

Splunk platform

Configuration 

Splunk Lantern Articles

Sysmon for Linux

Sysmon for Linux is a system monitoring tool that provides detailed insights into system activity, including process creations, network connections, and file modifications. It helps in detecting advanced threats and understanding system behavior by capturing high-fidelity event data, which is crucial for security monitoring and incident response.

Splunk platform

Configuration

Splunk Lantern Articles