How does the SA_Syslog_collection app gather stats from UF's?

[rpquinlan]

The app says that it needs to be installed on the indexers and the search heads, but how is the app to gather information (and perform the ' netstat -stu ' command mentioned in the docu) from the UF's without it being installed there as well?

I must be missing something simple.

[nickhills · Accepted solution]

Having a quick look at the inputs, its been designed to run netstat on the indexers, not the forwarders.

[rpquinlan]

That's how it appears to me as well, though the app's documentation talks about using syslog-ng on UF's and how it can gather additional metrics on the UF's.. Bummer.

[nickhills]

I guess you cold configure the UF app to run the same script on the forwarders too?

[rpquinlan]

Hmmm.. have a CRON job run the script and output it to a file that the UF watches... That is an idea!

[nickhills]

I meant as a scripted input - then you can manage it from your deployment server, without having to resort to cron.

[rpquinlan]

Got it! That's a better idea, working on that now.

[rpquinlan]

Brilliant. That's working, thank you for the suggestion!
Note for anyone else who may have a Windows deployment server and a *nix UF - you'll have to check/change the file permissions / owner on the .sh file after deployment,