All Apps and Add-ons

Collectd Docker Plugin for Splunk App Infrastructre is not working

drmeddenrasen
Explorer

Hello Everybody,
i want to monitor my docker containers with collectd and the Splunk infrastructure App, I followed the instructions of https://docs.splunk.com/Documentation/InfraApp/latest/Admin/ManageAgents, but when I want to start the collect deamon it comes up with these error Messages:

docker plugin: Buffer size is 16384, Data received=16384. Increase ReadBufferSize
docker plugin: curl_easy_perform failed with status 23: Failed writing received data to disk/application
docker plugin: Failed to get list of running containers

The Connection to my Splunk Server via hec is working fine, because i get the metrics of my physical machine, but not of these Docker containers. My Docker containers are running and i have checked the Docker.sock file with curl.

I am working on that problem for 2 days now. Would be great if anyone could help.

Best regards
Jannik

0 Karma
1 Solution

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

View solution in original post

drmeddenrasen
Explorer

I have antother question regarding this topic. At the Moment I can see only Docker Containers by ID and not by Name. Is there any possibilty to switch this? I tried it with lookup files, but it is not working with metrics.

Best regards
Jannik

drmeddenrasen
Explorer

OHH my god it works fine!!! Thanks a lot!!! 🙂

0 Karma

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...