topic Re: Reading Apache server-status output in Getting Data In

Reading Apache server-status output

mhouts001 — Mon, 25 Jul 2011 15:46:23 GMT

Has anyone tried to have splunk parse the output of the machine readable apache server-status page, e.g http://$apachehost/server-status?auto

I need to keep track of the status of workers, whether they are waiting, logging, etc.

Thanks

Re: Reading Apache server-status output

Brian_Osburn — Mon, 25 Jul 2011 16:14:01 GMT

I use a scripted input - I wrote a perl script to make a call to the Apache servers to pull stats..

I'll include the code below to get you started:

#!/usr/bin/perl

###
#Simple script to parse Apache Server statistics for Splunk
###

use LWP::UserAgent;

@apache_urls=("http://server1/server-status","http://server2/server-status","http://server3/server-status","http://server4/server-status");

foreach $url (@apache_urls) {
        my $ua = new LWP::UserAgent;
        $ua->agent('Splunk Apache Statistics Script');
        my $request = HTTP::Request->new('GET');
        $request->url($url);
        my $response = $ua->request($request);
        my $body = $response->content;

        ### Extract stats
        $body=~ m/Apache Server Status for ([^>]+)<\/h1>/;
        $server_name=$1;
        $body=~ m/Current Time: [^,]+, ([^<]+)<\/dt>/;
        $timestamp=$1;
        $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) kB\/second - ([^\s]+) kB\/request<\/dt>/;
        $request_stats="requests_per_second=$1,kB_per_second=$2,kB_per_request=$3";
        $body=~ m/<dt> ([^\s]+) requests currently being processed, ([^\s]+) idle workers<\/dt>/;
        $processing_stats="requests_currently_being_processed=$1,idle_workers=$2";
        print "$timestamp,ServerName=$server_name,$request_stats,$processing_stats \n";
}

Re: Reading Apache server-status output

mhouts001 — Mon, 25 Jul 2011 21:01:24 GMT

Outstanding, thank you. Figured this was the direction to take if there was no direct read of the status page.

Re: Reading Apache server-status output

Brian_Osburn — Tue, 26 Jul 2011 17:22:58 GMT

Please accept the answer if it solves your issue.

Thanks!

Re: Reading Apache server-status output

LK — Tue, 02 Aug 2011 15:58:47 GMT

Hi,

I fixed a few typos and extended the script to work on lower-traffic servers and to provide CPU usage:

#!/usr/bin/perl

###
#Simple script to parse Apache Server statistics for Splunk
###

use LWP::UserAgent;

@apache_urls=("http://server1/server-status","http://server2/server-status");

foreach $url (@apache_urls) {
        my $ua = new LWP::UserAgent;
        $ua->agent('Splunk Apache Statistics Script');
        my $request = HTTP::Request->new('GET');
        $request->url($url);
        my $response = $ua->request($request);
        my $body = $response->content;

        ### Extract stats
        $body=~ m/Apache Server Status for ([^>]+)<\/h1>/;
        $server_name=$1;
        $body=~ m/Current Time: [^,]+, ([^<]+)<\/dt>/;
        $timestamp=$1;
        $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) (k*B)\/second - ([^\s]+) (k*B)\/request<\/dt>/;
        $request_stats="requests_per_second=$1,$3_per_second=$2,$5_per_request=$4";
        $body=~ m/<dt>([^\s]+) requests currently being processed, ([^\s]+) idle workers<\/dt>/;
        $processing_stats="requests_currently_being_processed=$1,idle_workers=$2";
        $body=~ m/<dt>CPU Usage: u([^\s]+) s([^\s]+) cu.* cs.* - ([^\s]+%) CPU load<\/dt>/;
        $cpu_stats="user_cpu=$1,system_cpu=$2,cpu_load=$3";
        print "$timestamp,ServerName=$server_name,$request_stats,$processing_stats,$cpu_stats \n";
}

Re: Reading Apache server-status output

LK — Tue, 02 Aug 2011 22:11:53 GMT

Not sure why all the backslashes doubled themselves. Please be sure to correct that before using the script.

Re: Reading Apache server-status output

ThomasKoeberlei — Thu, 20 Oct 2016 15:24:18 GMT

Hi,

needed to change the line;

 $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) (k*B)\/second - ([^\s]+) (k*B)\/request<\/dt>/;

to:

 $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) (k*B)\/second - ([^\s]+) ([k,M]*B)\/request<\/dt>/;

regards,
-thomas