topic check server is up or not in Splunk Search

check server is up or not

manjuase — Tue, 25 Jul 2017 06:01:31 GMT

I have a lookup with the details of server and I want to check whether that servers are up or not. if not i have to send an email.

In my case pingstatus app is not working so i want some other methods which is not using ping command.

Thanks in advance

Re: check server is up or not

gcusello — Tue, 29 Sep 2020 15:03:17 GMT

Hi manjuase,
do you want to monitor up or down server status or specified services?
Because if you want to check server status, you could use Splunk internal logs (index=_internal host=your_host).
If instead you want to test specified services, you should use a script based on ps command (if linux) or Windows processes and check active processes comparing them with a processes lookup.
To find scripts see TA_Linux or TA_Windows.
Bye.
Giuseppe

Re: check server is up or not

manjuase — Tue, 25 Jul 2017 07:22:03 GMT

Hi cusello ,

Thanks for your reply..I want to check the server status only..

So you are saying that in "_Internal" index if am not seeing the server for which i want to check the status..then that server is down..right ?

Re: check server is up or not

gcusello — Tue, 25 Jul 2017 07:28:32 GMT

Hi manjuase,
I imagine that you have a Universal Forwarder installed and running on your server.
This means that Splunk UF is sending its logs to a Splunk Enterprise instance.
Using that search you can monitor if server is up or not and eventually send an alert (really you're testing Splunk Forwarder status, but UF is running on server!).

Bye.
Giuseppe

Re: check server is up or not

manjuase — Tue, 25 Jul 2017 07:40:55 GMT

Hi cusello,

Yeah i agree with your point ...from the internal index we can say if UF is running or not.. In case if server is running and UF is not running , we can't find that server in _internal index right?..So here we can't say server is down..here UF is down..

I want to check the status of server not the status of UF.

Do you have any idea on this ?

Re: check server is up or not

gcusello — Tue, 25 Jul 2017 07:53:21 GMT

Hi manjuase,
Yes but if your UF is down you lose every chance to monitor your server, so if server is up and UF is down I think it's a problem to immediately solve!
I suggest to use this way.
Anyway, you could test active processes on your server using a script based on linux ps command (see TA_Linux), but UF must be running so it's the previous case.

Bye.
Giuseppe.