Install the Linux App and view the Dashboards
Sumo Logic App
Now that you have set up collection for Linux, install the Sumo Logic App for Linux to use the preconfigured searches and dashboards to analyze your data.
To install the app:
Dashboards
Overview
Dashboard description: See an overview of Linux activity, including the distribution of system events across hosts, group assignment changes, a breakdown of successful and failed logins, sudo attempts, and the count of reporting hosts.
Filtering the Overview dashboard
Click the funnel icon in the upper left of the dashboard to display filtering options. You can filter the dashboard by any combination of command, dest_group, dest_hostname, and dest_user.
Event Sources
Dashboard description: See information about system events, including their distribution across hosts, event counts per host by hour, and even counts by host and service.
Filtering the Event Sources dashboard
Click the funnel icon in the upper left of the dashboard to display filtering options. You can filter the dashboard by any combination of dest_hostname, host, and process_name.
Login Status
Dashboard description: See information about logins to Linux hosts; including logins by hour; failed logins per host; the top 30 successful and failed logins; and the top 30 successful and failed remote logins.
Filtering the Login Status dashboard
Click the funnel icon in the upper left of the dashboard to display filtering options. You can filter the dashboard by any combination of action, dest_hostname, dest_user, and outcome.
Security Status
Dashboard description: See information about security on Linux hosts, including su, sudo attempts, new and existing user assignments, package operations, and system start events.
Filtering the Security Status dashboard
Click the funnel icon in the upper left of the dashboard to display filtering options. You can filter the dashboard by any combination of action, dest_hostname, dest_user, and outcome.