---
# System prepended metadata

title: Splunk - 20240126

---


Sprunk => 是一個平台

cat auth.log



### 時區調整 
date
sudo timedatectl set-timezone "Asia/Taipei"

sudo service syslog restart

cat auth.log | grep Fail*

### 監視log檔
sudo watch tail /var/log/auth.log

### 登入限制
sudo apt install fail2ban
service fail2ban status
service fail2ban start

sudo fail2ban-client status
sudo fail2ban-client status sshd

### 安裝Splunk
![圖片](https://hackmd.io/_uploads/HJJRV2xc6.png)
sudo dpkg -i splunk-9.1.3-d95b3299fa65-linux-2.6-amd64.deb

sudo /opt/splunk/bin/splunk start
10.167.216.96:8000

install APP
Fail2ban - TA for fail2ban 
Linux Secure Technology Add-On

新增檢索

搜尋語法

source="/var/log/fail2ban.log" AND Ban AND "10.167.216.*"

Fail2ban 設定檔
sudo vim /etc/fail2ban/jail.conf
100行 -> 



index="auth" action=failure src=* | dedup src



### 資料收集 splunk

Port 9997










