Forum Discussion

Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus

Hi,

You can have a look at the iApp Analytics written by Ken Bocchino.

On my side, I write a custom log in the format key/value to be natively parsed by Splunk.

You can write an icall that periodically dump (

sessiondump --allkeys
) all session variables from active sessions and send it to the HTTP API of Splunk.

Then, you have all at your disposal to build some custom dashboard based on easy to write splunk queries.

Hope it helps

Yann

CX_280703's avatar
CX_280703
Icon for Nimbostratus rankNimbostratus
Aug 23, 2017

We have set up our APM using HSL to send our logs to our syslog server on policy completion. This works well and allows us to choose the info we send.

when ACCESS_POLICY_COMPLETED {
  if { ![catch {set hsl [HSL::open -proto TCP -pool $static::syslogPool]} ] } {
         HSL::send $hsl "<190>    id=$static::siemId    action=auth    auth-result=\ACCESS::policy result]    dst-ip=[IP::local_addr]    src-ip=[IP::remote_addr]user=[ACCESS::session data get session.sso.token.last.username]@[ACCESS::session data get session.sso.token.last.domain]    vip=[virtual name]    use-case=[ACCESS::session data get session.sso.token.last.useCase]    ad-errmsg=[ACCESS::session data get session.ad.last.errmsg]  ad-empid=[ACCESS::session data get session.ad.last.attr.employeeID]   device=$static::location    module=APM    user-agent=[ACCESS::session data get session.user.agent]    auth-method=[ACCESS::session data get session.sso.token.last.method]    sessionID=[ACCESS::session data get session.user.sessionid] \n"
  }
}