All Apps and Add-ons

Collectd Docker Plugin for Splunk App Infrastructre is not working

drmeddenrasen
Explorer

Hello Everybody,
i want to monitor my docker containers with collectd and the Splunk infrastructure App, I followed the instructions of https://docs.splunk.com/Documentation/InfraApp/latest/Admin/ManageAgents, but when I want to start the collect deamon it comes up with these error Messages:

docker plugin: Buffer size is 16384, Data received=16384. Increase ReadBufferSize
docker plugin: curl_easy_perform failed with status 23: Failed writing received data to disk/application
docker plugin: Failed to get list of running containers

The Connection to my Splunk Server via hec is working fine, because i get the metrics of my physical machine, but not of these Docker containers. My Docker containers are running and i have checked the Docker.sock file with curl.

I am working on that problem for 2 days now. Would be great if anyone could help.

Best regards
Jannik

0 Karma
1 Solution

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

View solution in original post

drmeddenrasen
Explorer

I have antother question regarding this topic. At the Moment I can see only Docker Containers by ID and not by Name. Is there any possibilty to switch this? I tried it with lookup files, but it is not working with metrics.

Best regards
Jannik

drmeddenrasen
Explorer

OHH my god it works fine!!! Thanks a lot!!! 🙂

0 Karma

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...