Got a question for the slack channel. What’s the best way to get logs from IGEL OS (UD6) terminal to Splunk?
I have no experience with Splunk but I‘m seeing a few ways:
1) using SSH to the endpoint (if Splunk can connect through SSH), that needs to be set in a profile
2) having the device reporting the logfile to a Rsyslog Server: kb.igel.com/igelos-11.03.100/en/logging-24388483.html kb.igel.com/igelos-11.03.100/en/logging-24388483.html
3) using IMI: our RestAPI (might be a bit complex)
4) asking your Igel (Pre-)Sales rep. to check if there is a way to create a Custom Partition for you.
Thanks, @member. I’m under pressure to help make sure the SecOps team can get logs.
Hello @member are they looking for syslog information?
@member, they are looking to get audit information from the UMS and iGEL OS to Splunk. Keep in mind how many logging requirements are written – “all logs must be centrally managed blah blah blah”. Splunk is the central repository.
HI , the security operations team don’t want anything to do with third-part code they can’t support.
Continue reading and comment on the thread ‘What’s the best way to get logs from IGEL OS terminal to Splunk?
‘. Not a member? Join Here!
Learn more, search the IGEL Knowledge Base
Ask a question or comment on the above message thread?Join or log in to the IGEL Community to ask us anything and meet other IGEL customers, partners, and EUC enthusiasts.
Submit a question, or Join Today!
Popular Message Threads
- Error “AM_ERROR_AUTH_NETWORK_ERROR ” adding store in Citrix Workspace App version 20.x on IGEL OS 11.04
- How to Install IGEL OS via a Bootable USB Drive
- Receiving error: “Citrix Receiver cannot create a secure connection in this browser” when launching a secure connection from Firefox on IGEL OS
- How to change the default IGEL UMS admin password?
- Where to delete the certificates that cause ‘invalid certificate’ when trying to import an IGEL into UMS?
- Error connecting to Citrix StoreFront “Error adding store: Http error”
- IGEL UMS Universal Update Error: “could not resolve host name”