All Apps and Add-ons

Collectd Docker Plugin for Splunk App Infrastructre is not working

drmeddenrasen
Explorer

Hello Everybody,
i want to monitor my docker containers with collectd and the Splunk infrastructure App, I followed the instructions of https://docs.splunk.com/Documentation/InfraApp/latest/Admin/ManageAgents, but when I want to start the collect deamon it comes up with these error Messages:

docker plugin: Buffer size is 16384, Data received=16384. Increase ReadBufferSize
docker plugin: curl_easy_perform failed with status 23: Failed writing received data to disk/application
docker plugin: Failed to get list of running containers

The Connection to my Splunk Server via hec is working fine, because i get the metrics of my physical machine, but not of these Docker containers. My Docker containers are running and i have checked the Docker.sock file with curl.

I am working on that problem for 2 days now. Would be great if anyone could help.

Best regards
Jannik

0 Karma
1 Solution

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

View solution in original post

drmeddenrasen
Explorer

I have antother question regarding this topic. At the Moment I can see only Docker Containers by ID and not by Name. Is there any possibilty to switch this? I tried it with lookup files, but it is not working with metrics.

Best regards
Jannik

drmeddenrasen
Explorer

OHH my god it works fine!!! Thanks a lot!!! 🙂

0 Karma

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...