Alerting

XenServer 5.6

leandesk
New Member

how to configure xenserver with splunk? any step by step document

Tags (1)
0 Karma

leandesk
New Member

There is app splunk for xenserver . How to setup for xenserver pool

0 Karma

treinke
Builder

I have never got that to work.

There are no answer without questions
0 Karma

treinke
Builder

Do you mean XenApp and not XenServer? If you installed XenApp on a Unix/Linux system, according to the following article you need to add the user.info and user.notice to the syslog.conf file and then use the ctxcfg to configure the level of logging for the user connect/disconnect/reconnect/logoffs.

http://support.citrix.com/proddocs/topic/ps-unix/ps-unix-deploy-event-logging.html

There are no answer without questions
0 Karma

treinke
Builder

If you want to collect the logs from within XenServer:

  1. Open XenCenter and right click on the XenServer you want to configure to send syslog to Splunk and select Properties.

  2. Click on the Log Destination tab

  3. Select the Remote selection

  4. Enter the IP address of the Splunk server

  5. Select OK

  6. Repeat the above steps for all remaining XenServers

If you want the server messages, you will need to edit the syslog.conf file.

  1. vi /etc/syslog.conf

  2. Add the details you want to send to Splunk. Below is an example.

    .crit;.emerg;.info;mail.;authpriv.;cron.;local6.* @splunk.localdomain

W*ithin Splunk, you need to make sure to listen on UDP port 514 to capture Syslog traffic.*

  1. Open up Splunk and go to Manager

  2. Under Data, select Data inputs

  3. Under UDP, select Add new

  4. List item

  5. In UDP Port, type in 514. Under Source type, set the sourcetype to From list and then in the list choose syslog.

  6. List item

  7. Click Save

There are no answer without questions

leandesk
New Member

How to get this data for the app for xenserver?

0 Karma

rajneeshsaraswa
New Member

I need to configure logs for below files to splunk.

SMlog
audit:
messages: Xensource.log:

how to set

0 Karma

MarioM
Motivator

do mean install splunk on a xenserver or collecting xenserver data?

0 Karma

rajneeshsaraswa
New Member

collecting xenserver data on to the splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...