## Overview This project delivers a robust **Linux log monitoring and visualization platform** built entirely within **Splunk’s Classic XML dashboard framework**. Designed for UNC's SILS infrastructure, the dashboard aggregates and parses multiple Linux system and application logs, giving IT staff a fast and visual way to identify failures, performance anomalies, and security concerns.

--- ## Key Features ### 🔍 System Log Panel with Dynamic Category Selector - Dropdown selector to toggle views between system logs like: - `/var/log/syslog`, `/var/log/auth.log`, `/var/log/kern.log`, `/var/log/dmesg`, `/var/log/mail.log`, `/var/log/sudo.log`

- Each panel includes: - **Explanatory summaries** for context - **Charts and tables** for 30-day trends, common error types, and top actors --- #### 🔐 Authentication Log Analysis - Tracks login attempts and sudo command usage over time - Displays failed login attempts by IP, helping detect **brute-force activity** - Shows sudo usage trends as an indicator of privilege use

--- #### ⚙️ Kernel, Package & Boot Diagnostics - `/var/log/kern.log` and `/var/log/dmesg` visualizations: - **Critical kernel events** - **Top error types by keyword** (e.g., BIOS, ECC, smp) - `/var/log/dpkg.log` summaries for: - Installed or upgraded packages - Frequent package types and update patterns

--- ### 🔧 Application Log Panels #### 🖥️ Zabbix Logs - Analyze `/var/log/zabbix/zabbix_agent2.log` - Use the **Zabbix log type selector** for targeted visualizations --- #### 📁 File Integrity Logs - Monitor logs like `/var/log/aide/aide.log` - Use the **AIDE log selector** to enable this panel --- #### 🧸 Puppet Logs - Inspect Puppet logs like `/var/log/puppetlabs/pxp-agent/pxp-agent.log` - Select from the **PUPPET panel** to drill into logs --- #### 🌐 Apache Logs - View Apache logs including: `/var/log/apache2/access.log` `/var/log/apache2/access_ssl.log` `/var/log/apache2/error.log` `/var/log/apache2/error_ssl.log` - Use **Apache log dropdown** to explore each log type

--- ## Technologies Used - **Splunk 9.4.3 Classic XML** dashboard framework - `monitor://` stanza ingestion for over 10 log types - Sourcetypes: `linux_messages_syslog`, `linux_secure`, `apache:access`, `apache:error`, `postfix_syslog` - Dynamic UI controlled with `

` tokens and `` conditions - Custom queries using `rex`, `stats`, `eval`, `timechart`, `table`, and `head` --- ## Challenges & Learnings - Learned to write **modular, token-driven dashboards** in Splunk’s Classic XML format - Built category toggles to handle **multi-sourcetype logs in one view** - Ensured visualizations were **contextual and beginner-friendly**, with explanation blocks before every chart - Managed search performance and optimized SPL queries for real-time use --- ## Outcome This Splunk dashboard is now used by UNC SILS staff to: - Monitor system behavior and log activity across IT-managed servers - Detect login anomalies, package drift, and service disruptions - Offer a teachable interface for students learning about system logging and cybersecurity The design principles used here can be applied to other departments or schools aiming to adopt visual log monitoring with limited infrastructure.