All Apps and Add-ons

Collectd Docker Plugin for Splunk App Infrastructre is not working

drmeddenrasen
Explorer

Hello Everybody,
i want to monitor my docker containers with collectd and the Splunk infrastructure App, I followed the instructions of https://docs.splunk.com/Documentation/InfraApp/latest/Admin/ManageAgents, but when I want to start the collect deamon it comes up with these error Messages:

docker plugin: Buffer size is 16384, Data received=16384. Increase ReadBufferSize
docker plugin: curl_easy_perform failed with status 23: Failed writing received data to disk/application
docker plugin: Failed to get list of running containers

The Connection to my Splunk Server via hec is working fine, because i get the metrics of my physical machine, but not of these Docker containers. My Docker containers are running and i have checked the Docker.sock file with curl.

I am working on that problem for 2 days now. Would be great if anyone could help.

Best regards
Jannik

0 Karma
1 Solution

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

View solution in original post

drmeddenrasen
Explorer

I have antother question regarding this topic. At the Moment I can see only Docker Containers by ID and not by Name. Is there any possibilty to switch this? I tried it with lookup files, but it is not working with metrics.

Best regards
Jannik

drmeddenrasen
Explorer

OHH my god it works fine!!! Thanks a lot!!! 🙂

0 Karma

mpise_splunk
Splunk Employee
Splunk Employee

Please add/increase ReadBufferSize in docker stanza in file /etc/collectd/collectd.conf on docker host.
example,
```

       dockersock "/var/run/docker.sock"
       apiversion "v1.20"
       **ReadBufferSize 32000**

```
You may have tune this value depending on the number of docker containers on your host.

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...