Friends who are using splunk strictly as a logger liked it. We had
hell of a lot of pain implementing 4.0. They don't understand the
concept of dropping privs, so it has to run as root. My company does
not allow the non-os team to have root. So endless fucking around
with permissions and "hey unix team, can you please do this so that we
can continue troubleshooting".
And to top that, 4.0 through about 4.09 were feature *and* bug rich.
They have agents which have to be installed and upgraded manually each
time. Few hundred servers and that starts to get a bit old.
And sux on aix (ok, that's our fault - the asshole who bought it
bought a p520 instead of a x86 box. Before a solution/product was
even finalized).
And some kind of buffer overflow issue which I think is fixed now.
So, if you're looking for something to sit on 512 and other assorted
ports to receive logs, and index them, and give you a pretty interface
to do searches on non-normalized data on linux, splunk's pretty nice.
If you need to use some of their "additional" features (agents, etc)
test it out first before doing it. Fortunately, you can get an annual
500meg/day license for free by just asking.
On 8/14/10, Toni Mueller <openbsd-misc@oeko.net> wrote:
