Splunk Analytics for Real-Time Systems Monitoring in HPC: LANL’s HPC Division’s Production Splunk Use Cases
Explore the source record for details and available documents.
Computer Science↗
SEARCH · Engineering Papers
Results for “Splunk”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Automating Log Synthesis and Visualization with Python and Splunk
The goal of this project is to automate log analysis by utilizing Splunk, Bash, and Python together. Simplifying the monitoring and analysis of network traffic was the main goal. In order to accomplish this, a Bash script was created to use 'tcpdump' to automate network sniffing. It also included a 24-hour file rotation mechanism to effectively manage the pcap files that were generated. After that, a Python script was written to read these pcap files and retrieve pertinent data about network traffic. After processing the collected data, Splunk is used to summarize the important metrics and visualize said information with relevant graphs.
99 GENERAL AND MISCELLANEOUS↗
Using Splunk® Enterprise Search Commands for Advanced Analysis of Ivanti Connect Secure© Logs
Analyzing the logs of even the smallest Information Technology (IT) system can be a challenge considering they can generate millions of lines of log data in a very short time. Splunk® Enterprise is an industry leading tool that allows analysis of log data, which can enhance troubleshooting capabilities, improve system performance, and improve the security posture of an IT system. Ivanti Connect Secure© (ICS) is a market-leading platform powered by the Ivanti Secure Socket Layer Virtual Private Network (SSL VPN) appliance, providing an architecture for secure access to and protection of network resources. This paper describes an approach for using Splunk Enterprise search capabilities to perform advanced data analysis of ICS logs.
97 MATHEMATICS AND COMPUTING↗
Prototyping FLAG Monitoring in Splunk
Outline: Background; Motivation; Toolbox; Workflow; Results: Tracking & Reporting in Splunk; Wrap Up/Future Work/Questions
97 MATHEMATICS AND COMPUTING↗
HPC Test Results Analysis with Splunk
This PowerPoint presentation details Los Alamos National Laboratory’s (LANL) outstanding computing division. LANL’s high performance computing (HPC) aims at having the first platform large and fast enough to accommodate resolved 3D calculations for full scale end-to-end calculations. Strategies for managing LANL’s HPC division are also discussed.
97 MATHEMATICS AND COMPUTING↗
Essentials to creating your own Security Posture using Splunk Enterprise
Explore the source record for details and available documents.
97 MATHEMATICS AND COMPUTING↗
Analyzing Risks of Virtual Private Network Connections
The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.
97 MATHEMATICS AND COMPUTING↗
Parallel File System I/O Performance Testing On LANL Clusters
These are slides from a presentation on parallel file system I/O performance testing on LANL clusters. I/O is a known bottleneck for HPC applications. Performance optimization of I/O is often required. This summer project entailed integrating IOR under Pavilion and automating the results analysis. The slides cover the following topics: scope of the work, tools utilized, IOR-Pavilion test workflow, build script, IOR parameters, how parameters are passed to IOR, *run_ior: functionality, Python IOR-Output Parser, Splunk data format, Splunk dashboard and features, and future work.
97 MATHEMATICS AND COMPUTING↗
GUIDE: A Scalable Information Directory Service to Collect, Federate, and Analyze Logs for Operational Insights into a Leadership HPC Facility
In this paper, we describe the GUIDE framework to collect, federate, and analyze log data from the Oak Ridge Leadership Computing Facility's (OLCF), and how we use it derive insights into center operations. We collectsystem logs and extract monitoring data at every level of the various OLCF subsystems, and have developed a suite of pre-processing tools to make the raw data consumable. The cleansed logs are then ingested and federated into a central, scalable data warehouse, Splunk, that offers storage, indexing, querying, and visualization capabilities. We have further developed and deployed a set of analytics tools to analyze these multiple disparate log streams in concert, and derive operational insights. We describe our experience from developing and deploying the GUIDE infrastructure, and deriving valuable insights on the various subsystems, based on two years of operations in the production OLCF environment.
Vazhkudai, Sudharshan↗