Bauer, Scott

x

x

Sumo Logic

Discussion Points:

• IP addresses and Domain
  • NIH is concerned IPs are PII.
  • Not PII if collected in aggregate
  • Is is PII if collected in server logs
  • We will need to get Eric's opinion on this.  Larry has asked him.
  • If we could drop the last 2 stanzas, there would be no issues.
    • This is a "B" level address.
    • This will allow us to determine domains still.
  • Larry - There is a unix call to convert IP to domain. 
    • You can input an access file, and it would replace the IP with the domain.
    • You can also filter the access file to just add the first 2 stanzas of the IP.
  • Command: logresolve - pass the http.access file through this command before sending the access file around so the IP is filtered. 
    • This command could be called just before the aggregator get the log.  This will allow Google API to use the access file with the IP in it.
  • Sumo gathers data from websites and APIs.  Google API is just for websites.
• Sumo Logic Scheduling will be addressed on Friday
  • Officially we get a license on June 16th.
  • Potentially, we could have logs a week after that.
• Sumo has a SaaS solution
  • We need a "collector" on each server.
    • One collector can collect files for multiple services on the server.
  • Configure the reporting and we are done.
  • Security should be built in.
    • It is a SaaS tool.  Connect to it with Octa.
    • Only EVS users will be able to see EVS logs.

Decision Points:

Discussion Points:

• Sumo Logic Kickoff Meeting for NCI - Friday 6/11
• We are one of 3 projects that want to use Sumo Logic out of the gate
• Team will be talking with Sumo Logic
• Scott has invite to the meeting