topic Re: Monitoring CPU,RAM, and disk usage of splunk forwarders in All Apps and Add-ons

Monitoring CPU,RAM, and disk usage of splunk forwarders

israbenbr — Mon, 29 Nov 2021 12:36:40 GMT

Hello everyone,

I am posting this question because I didn't find any solution :

I have a trial version of Splunk Enterprise, and i already added forwarders in the servers i want to monitor

I am trying to install the Splunk add-on for unix and Linux on these forwarders to be able to monitor their cpu, ram and disk usage

The problem is that these machines are under ubuntu 20.04 without a graphic interface, and no option is available to download the .tgz file of this add-on directly via a command line, so i am unable to download this file on my forwarders

Any ideas ?

PS : If no link/command is available to do so, is there another way to import the ram,cpu and disk data from these forwarders ?

Thank you in advance !

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

gcusello — Mon, 29 Nov 2021 12:55:49 GMT

Hi @israbenbr,

you have two choices to deploy tour TA:

manually deploying:
- copy the TA in the $SPLUNK_HOME/etc/apps folder of the client,
- untar it
- set disabled=0 in the stanzas of inputs.conf of this app,
- ther restart Splunk on the client;
using Deployment Server:
- run the command to configure your client as client for a Deployment server (as described at https://docs.splunk.com/Documentation/Splunk/8.2.3/Updating/Configuredeploymentclients) in few words "splunk set deploy-poll <IP_address/hostname>",
- restart splunk on the client,
- copy the TA in $SPLUNK_HOME/etc/deployment-apps of the Splunk server,
- untar it,
- create a ServerClass via UI (as described at https://docs.splunk.com/Documentation/Splunk/8.2.3/Updating/Definedeploymentclasses).

For a test you could also use the first method that's easier, but I hint to try the second one because it's the usual way in Splunk when you have many clients to deploy.

Ciao.

Giuseppe

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

israbenbr — Mon, 29 Nov 2021 13:02:22 GMT

Hello,

thank you for your answer but that is not the problem

My problem is that i am not even able to download the TA on my forwarders, because the only option to do it is to connect to the splunk portal via a web interface, and my forwarders are all under ubuntu withtout a graphic interface

So i can not open a browser, because the only operations i can do are via command lines.

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

gcusello — Mon, 29 Nov 2021 13:04:35 GMT

Hi @israbenbr,

if you can connect via SSH, you can follow the second method because the download to the client is managed by The Deployment Server.

Ciao.

Giuseppe

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

israbenbr — Mon, 29 Nov 2021 14:58:49 GMT

Hey,

I am coming back because i have a problem :

After configuring the forwarder to be a deployment client, this one doesn't show up on the deployment management on the server

I tried with another forwarder, same problem

I tried everything : restarting splunk on both the server and the client, but nothing works

Any ideas ?

Thank you

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

gcusello — Mon, 29 Nov 2021 15:09:58 GMT

Hi @israbenbr,

at first, did you checked that the route between clients and the server are open?

you can check this using:

telnet ip_server_splunk 8089 telnet ip_server_splunk 9997

before the second check you have to enable receiving on the Splunk server [Settings -- Forwarding and Receiving -- Receiving] on one port (default 9997).

then you have to address the client to send logs to the Server, you can do this following the documentation at https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/Configuretheuniversalforwarder

in few words, you have to run on the client in CLI

./splunk add forward-server <host name or ip address>:<listening port>

In this way you create a file $SPLUNK_HOME/etc/system/local/outputs.conf that contains the address of the server to send logs.

In the same location, you'll have the file deploymentclient.conf, containing the address of the Deployment Server, in your test case, the same.

Ciao.

Giuseppe

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

israbenbr — Wed, 01 Dec 2021 12:05:41 GMT

Hi again,

Thank you very much, the problem was that the ports were not opened

thank you !

Re: Monitoring CPU,RAM, and disk usage of splunk forwarders

gcusello — Wed, 01 Dec 2021 12:07:24 GMT

Hi @israbenbr,

ok, good fro you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉