Syslog-ng

shib·bo·leth (shĭb'ə-lĭth, -lĕth')
n.

1. A word or pronunciation that distinguishes people of one group or class from those of another.
2. 1. A word or phrase identified with a particular group or cause; a catchword.
   2. A commonplace saying or idea.
3. A custom or practice that betrays one as an outsider.

http://www.campin.net/newlogcheck.html

http://www.oreilly.com/catalog/bssrvrlnx/chapter/ch10.pdf

http://www.balabit.com/products/syslog_ng/

http://dmourati.blogspot.com/2006/02/splunk-question-and-answer.html

http://dmourati.blogspot.com/2006/01/splunk-and-syslog-ng.html

Sphere: Related Content

Splunk Integration With OpenSSH

This blog post covers Splunk Integration with OpenSSH. OpenSSH is the lifeblood of any distributed Linux system. I practically live inside and SSH session. During any given day, I may SSH into 20 different system all around the world. As such, it is important to keep track of what SSH is doing. What better way than with Splunk?

This integration actually picks up after some work I did earlier integrating Splunk with Syslog-ng. For more information on how I'm setup, please read my earlier post

Splunk and syslog-ng

Now that I have remote syslog enabled, I can do all kinds of cool stuff. This is especially useful for troubleshooting large networks of interconnected systems where SSH is undoubtedly already in play. My syslog-ng configuration is already being processed by Splunks tailingprocesser which is looking at all the stock syslog-ng files plus per host syslog-ng directories for remote syslog. Here' s a look at my central syslog-ng configuration:

[root@demetri05 log]# find remote-syslog-ng/
remote-syslog-ng/
remote-syslog-ng/demetri04
remote-syslog-ng/demetri04/secure
remote-syslog-ng/demetri04/messages
remote-syslog-ng/demetri04/cron
remote-syslog-ng/demetri04/boot.log
remote-syslog-ng/demetri04/maillog
remote-syslog-ng/demetri04/kern
remote-syslog-ng/demetri05
remote-syslog-ng/demetri05/boot.log
remote-syslog-ng/demetri05/cron
remote-syslog-ng/demetri05/secure
remote-syslog-ng/demetri05/messages
remote-syslog-ng/demetri05/maillog
remote-syslog-ng/demetri05/kern
remote-syslog-ng/splunk
remote-syslog-ng/splunk/demetri04-messages
remote-syslog-ng/splunk/demetri05-messges


To get a sense of just how pervasive SSH is in my environment, take a look at the following splunk. This shows that in the past day, there are over 10,000 events relating to SSH. Wow. So far I've uploaded all the standard SSH messages I could generate. That turned out to be around 20 types or so. Now, I'm going to make some changes to my SSH server to increase its logging level. Take a look at the /etc/ssh/sshd_config file for reference:

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

You'll notice a large uptick in the number of events starting in the 12:00 PM hour today. That's becaue I've changed the LOGLEVEL configuration in my /etc/ssh/sshd_config file to DEBUG. WARNING, don't do this on any system with real users. According to the manpage "Logging with a DEBUG level violates the privacy of users and is not recommended." This is my system and I'm the only user so I can proceed but I won't leave this in place beyond my work today for reasons of privacy and also to keep my log files manageable.

Here's a look at the type of events generated by the inceased LOGLEVL in SSHD. This time I'm splunking for sshd debug1.
That's kind of cool, actually. Now I have a whole set of new event types to upload to SplunkBase. Again, the fact remains that real systems shouldn't be configured with this level of logging for SSH but I'll make sure to note that in all my event descriptions once they're uploaded. I'm going to simplify my work by sorting the events into event types and then uploading each event type on up to SplunkBase for integration. That way I'll be sure to get all the event types up there without worrying about duplicating log submissions. At the moment, I see 36 event types related to SSH and the new DEBUG loglevel I've put in place.
I'm drilling down on each of these event types, then uploading the corresponding log entry up to splunk base one at a time. It seems like this is uncharted territory as far as SplunkBase is concerned. Each of these event types are new which is cool.

As I go, I'm keeping an eye on the total number of event types I've submitted to SplunkBase by watching my splunk user page here:

http://www.splunk.com/user/dmourati

At the moment, I'm at 383 total event types submitted and counting. Completing this SSH debug logging should push the total above 400 types.

Now I'm going to reset the LOGLEVL on my SSH configuration to turn off all this DEBUG level logging.
That in turn generated a bunch more event types moving the total from 36 to 43. Hmm. Let me add those for good measure. The new event types are easy enough to spot because they each have only one associated event.

Here's a link to the last event type from my SSH DEBUG testing:

http://www.splunk.com/event/SP-CAAAC5H

Sphere: Related Content

Splunk Integration with Firefox

OK, so this isn't much of an integration, per se. But a nice tip nonetheless.

I've been doing a lot of splunking lately. Here's one tip I wish I had back when I got started.

First, upgrade to Fifrefox 1.5. I downloaded a linux tarball here:

http://www.mozilla.com/products/download.html?product=firefox-1.5.0.1&os=linux&lang=en-US

Go to Edit->Prefences
Select Tabbed Browsing
Select "New Tab" from the "Load Web Browswer Links into a:" pulldown.

Note, under windows, the option was slightly different. There I had to
Go to Tools->Options->Tabs

Force Links That Open New Windows in:
* a new tab

Next, for either platform, open the following url in your location bar:

about:config



Look for the preference name

browser.link.open_newwindow.restriction

Set it to 0.

Now when the JavaScript windows for SplunkBase pop up in the Check splunk.com links, they resulting page will open in a new tab instead of a new window.


One more tweak was to overcome irritating messages about unresponsive scripts. I used about:config again this time to set

dom.max_script_run_time

to 30

Other users have reported a similar need to tweak the script runtime max for Yahoo sites as well as gmail.

Here's more info on the above:

http://www.mozilla.org/support/firefox/tips

Nice.

Sphere: Related Content

$1000 Laptop

"Hardware is a small part of the cost" of providing computing capabilities, he said, adding that the big costs come from network connectivity, applications and support.




Bill Gates mocks MIT's $100 laptop project - Yahoo! News






You know what I like about Microsoft?

Nothing.

You whow what I like about Bill Gates?

Nothing.

Yesterday I could have appluaded him for his humanitarian efforts, cover of Time, all that jazz. But now? What kind of sick bastard endows a foundation with $29 million for global health and learning then turns around and slams the $100 laptop?

It's a project from MIT. Oh, yea, I guess those guys don't know what they are talking about.

http://laptop.media.mit.edu/

$100 laption, pshaw.

No, what you really need is my $1000 "ultra mobile computer." Just say that with your geekiest voice "ULTRAMOBILE COMPUTER!! UBC!! NNNAAAAA NAAAA"

What Is the Ultra-Mobile PC you ask?

The Ultra-Mobile PC is a new kind of computer. It combines the power of Windows XP with mobile-ready technologies that make it easy to access and use your software on the go.

With small, lightweight, carry-everywhere hardware designs, you can connect and communicate, accomplish any task anywhere and at any time, and be entertained and informed wherever life takes you.

Would whoever wrote that please stand up and report for beating with a wiffle ball bat?

Thank you.

So, what OS do you suppose runs on the MIT project?

Ask Nicholas Negroponte.

The machines, which will run a version of the Linux operating system, will also include other applications, some developed by MIT researchers, as well as country-specific software. "Software has gotten too fat and unreliable, so we started with Linux," he said.

Hmm. Sounds about right.

Sphere: Related Content

Phone, media firms see mobile ads soon - Yahoo! News

Phone, media firms see mobile ads soon - Yahoo! News

Sphere: Related Content

Is Dell buying Alienware? - Engadget

Is Dell buying Alienware? - Engadget

Sphere: Related Content

Systems architect - Wikipedia, the free encyclopedia

Systems architect - Wikipedia, the free encyclopedia

Sphere: Related Content

Nuasis NuContact Center 3.0

Here are some press links around the recent release of the Nuasis NuContact Center Version 3.0.

CRM Magazine/Destination CRM

Article headline: All the Talk at VoiceCon: The contact center market continues its migration to IP as vendors make a host of IP-related announcements
http://www.destinationcrm.com/articles/default.asp?ArticleID=5894

NOTE: Nuasis spoke to writer, Coreen Bailor, and the analyst who is quoted, Joe Outlaw. While the article states that there were a "slew of product enhancements, new services and rebranding" at VoiceCon, only Nuasis, Cisco and Avaya are referenced in the article.

Destination CRM is the CRM industry's largest, most successful website which includes the newsletter, CRM eWeekly and the digital version of CRM Magazine, both with 95,000 opt-in subscribers. Readership is mixed between IT management, corporate management and sales/marketing/services.

VoIPLoop: IP Telephony for the Enterprise

Article headline: VoiceCon Spring '06: Interview with Kevin McPartlan, Vice President of Nuasis

http://www.voiploop.com/index.php?option=com_content&task=view&id=899&Itemid=1

NOTE: Before VoiceCon, Nuasis spoke to Alex Dunne, editor of VoIPLoop - the written interview is the link above.

Podcast headline: VoIP Security with Brendan Ziolo of Sipera Systems and IP Contact Center Issues with Kevin McPartlan of Nuasis

http://voicecon.libsyn.com/index.php?post_id=66465

NOTE: During VoiceCon, Nuasis spoke to Eric Krapf, VoiceCon conference co-chair and editorial director of BCR Magazine. Eric conducted a podcast interview with Kevin McPartlan.

Blog headline: VoiceCon Conference within a Conference Preview

http://www.voiploop.com/index.php?option=com_content&task=view&id=887&Itemid=34

NOTE - Nuasis talked to Sheila McGee-Smith before VoiceCon. The panel that Sheila discusses in her blog had a standing-room only audience and a standing-room only crowd outside the meeting room who listened to the panel discussion through the room's open door. Panel participants were executives from Avaya, Cisco, Genesys, Nortel and Nuasis' Kevin McPartlan.

VoIPLoop is an online interactive forum for analysts, press, end-users and vendors. It is a CMP Online Publication that was launched in late 2005.

Customer Interaction Solutions/TMCNet

Article headline: Nuasis Says NuContact Center 3.0 Now Available

http://news.tmcnet.com/news/2006/03/07/1434393.htm

Article headline: First Coffee - Cingular Announces Video, Nuasis Announces NuContact Center 3.0, Parature Announces Another Customer

http://www.tmcnet.com/usubmit/2006/03/07/1434332.htm

NOTE: Also mentioned in this article is Nuasis' newest customer, Southwest Gas.

TMCnet.com is the online site that accompanies TMC's four print publications. TMCnet.com imparts information that helps readers become communications and call center technology advocates who make purchasing decisions and participants who will make these technologies work in any given implementation -- whether it be call centers, the central office or a corporate enterprise. The site currently averages over 7 million page views and reaches on average 650,000 unique visitors per month.

CRMAdvocate - Everything CRM - Read Less. Know More.

TODAY'S NEWS

Nuasis announced the availability of NuContact Center 3.0 software. This release supports agents located anywhere, higher system scalability, and advanced conditional routing based on customer intelligence and business analytics. NOTE: Nuasis' announcement of 3.0 was the lead story in the March 7 edition of CRMAdvocate.

CRMAdvocate is the definitive and most complete source of information concerning technologies, strategies, and trends for Customer Relationship Management (CRM) and Contact Centers. Providing real-time and on-demand industry news, webcasts, case studies, white papers, research, and product information, CRMAdvocate allows end-users, editors, research analysts, system integrators, consultants and others to stay current on industry trends. Owned by RealMarket, CRMAdvocate is headquartered in Indianapolis, Indiana.

Call Center Magazine/CommWeb and Communications Convergence.com

Article Headline: Nuasis NuContact Center 3.0: The Updated System Supports Remote Agents and Has Greater Scalability

http://www.cconvergence.com/shared/article/showArticle.jhtml?articleId=181501745

CommWeb and its sister site, CommunicationsConvergence.com (Call Center Magazine online) reach the people who make the business communication technology buying decisions.CommWeb/cConvergence's editorial provides end users and the telephony resellers that serve them the information they need to get their jobs done.

CMP Call Center Network

Sphere: Related Content