topic Re: overall splunk monitoring in Getting Data In

overall splunk monitoring

andersmholmgren — Wed, 01 Feb 2012 01:54:44 GMT

What is needed to monitor that splunk is running properly.

There is the Deployment Monitor App (http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor) as well as the SoS app (http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk), but is that all that is needed?

Isn't there some kind of monitoring outside of splunk that is needed - e.g. monitoring that splunk processes (splunkd, splunkweb) are running? Any pointers around an overall monitoring strategy?

Re: overall splunk monitoring

MuS — Wed, 01 Feb 2012 08:03:57 GMT

Hi andersmholmgren

like any other IT system/server Splunk as well needs basic monitoring from the outside. a good start is for sure to monitor the two processes mentioned by you, but also keep in mind that there could be much more involved like SAN, NFS, network and so on.

hope this helps

cheers

Re: overall splunk monitoring

andersmholmgren — Thu, 02 Feb 2012 06:12:38 GMT

Thanks MuS

Do you know of a good reference for the processes to monitor and their lifecycles?

I've noticed that splunkd instances seem to come and go if I'm not mistaken.

Re: overall splunk monitoring

MuS — Thu, 02 Feb 2012 08:54:40 GMT

Hi andersmholmgren

the most important process is the one you get with 'splunk status' listed as first, this is the main splunkd:

splunkd is running (PID: xxxxx).
splunk helpers are running (PIDs: xxxxx xxxxx).
splunkweb is running (PID: xxxxx).

other splunkd's are helpers and searches which makes no sense to monitor those - because as you said they come and go 😉

Re: overall splunk monitoring

shivang14 — Wed, 25 May 2016 13:26:41 GMT

Hi Mus,
How can we monitor the SBOX hosting Splunk environment ?
Can Splunk monitor its own OS and Hardware on which it is hosted ?
What is the best practivce to monitor SBOX ?
Regards
Shivang Kanoujia

Re: overall splunk monitoring

shivang14 — Wed, 25 May 2016 13:33:50 GMT