https://community.splunk.com/t5/Getting-Data-In/Monitor-files-perfomance/m-p/410928#M72765 <P>Hello,</P> <P>I need to monitor some Oracle Database agent logs with Splunk Universal Forwarder. The base directory for finding the logs is $ORACLE_HOME.</P> <P>We´re using this configuration to monitor these logs in a Splunk Enterprise environment:<BR /> <STRONG>[monitor://$ORACLE_HOME/log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log]</STRONG><BR /> ...</P> <P>I know we could configure ORACLE_HOME env in splunk-launch.conf on each UF instance. <BR /> However, we have already installed all Universal Forwarders and we don´t know the $ORACLE_HOME env variable on the UF hosts. <BR /> we have about 300 hosts, so we decided to do the above configuration to save time:<BR /> <STRONG>[monitor:///.../log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log]</STRONG></P> <P>When I execute <STRONG>splunk list monitor</STRONG> its listing all directories under <STRONG>/</STRONG> partition, even if there is one log file per host.</P> <P>My questions are:</P> <P>1 - Does Splunk will really look into all directories under <STRONG>/</STRONG>?<BR /> 2 - If yes, would I have performance problems because the huge amount of directories?</P> <P>Thanks.</P> Wed, 30 Sep 2020 00:07:18 GMT douglasmsouza 2020-09-30T00:07:18Z https://community.splunk.com/t5/Getting-Data-In/Monitor-files-perfomance/m-p/410928#M72765 <P>Hello,</P> <P>I need to monitor some Oracle Database agent logs with Splunk Universal Forwarder. The base directory for finding the logs is $ORACLE_HOME.</P> <P>We´re using this configuration to monitor these logs in a Splunk Enterprise environment:<BR /> <STRONG>[monitor://$ORACLE_HOME/log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log]</STRONG><BR /> ...</P> <P>I know we could configure ORACLE_HOME env in splunk-launch.conf on each UF instance. <BR /> However, we have already installed all Universal Forwarders and we don´t know the $ORACLE_HOME env variable on the UF hosts. <BR /> we have about 300 hosts, so we decided to do the above configuration to save time:<BR /> <STRONG>[monitor:///.../log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log]</STRONG></P> <P>When I execute <STRONG>splunk list monitor</STRONG> its listing all directories under <STRONG>/</STRONG> partition, even if there is one log file per host.</P> <P>My questions are:</P> <P>1 - Does Splunk will really look into all directories under <STRONG>/</STRONG>?<BR /> 2 - If yes, would I have performance problems because the huge amount of directories?</P> <P>Thanks.</P> Wed, 30 Sep 2020 00:07:18 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-files-perfomance/m-p/410928#M72765 douglasmsouza 2020-09-30T00:07:18Z https://community.splunk.com/t5/Getting-Data-In/Monitor-files-perfomance/m-p/410929#M72766 <P>Yes and Yes. Ideally its not recommended to use wildcard at root level as it'll cause UF to recursive walkthrough all those files/directories. You will see performance impact because of that. (high CPU). Will the $ORACLE_HOME be different in all those UFs?? You can either have the server owner create a symlink for you, that you'll monitor (same symlink pointing to appropriate Oracle installation directory) OR create a monitoring stanza that will take care of variations in $ORACLE_HOME values.</P> Wed, 30 Sep 2020 00:11:53 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-files-perfomance/m-p/410929#M72766 somesoni2 2020-09-30T00:11:53Z