All Apps and Add-ons

*Nix add-on with official universal forwarder docker: cannot run cpu.sh nor install sar/mpstat in splunk's official container

leomeyerovich
Explorer

We're able to partially get the official Splunk universal forwarder docker container to run the official *Nix add-on so an endpoint can collect & send its basic host metrics, but some of the add-on's host metrics collector scripts fail, such as cpu.sh:


[ansible@alpha bin]$ cat debug--cpu.sh--Wed_Jan__1_12-35-08_UTC_2020
Not found any of commands [sar mpstat] on this host, quitting

Most scripts run fine like netstat/top/ps as we do docker run --pid=host. However, it looks like the official container is stripped down, so cpu.sh has missing dependencies as above.

We were just going to apt-get install sar... except we see no apt-get/apt/apk/yum:

-- Is there an alternate universal forwarder container we can put on these endpoints? This feels like the usual "alpine vs slim" issue, and other enterprise projects do stuff like dual releases here, but I couldn't find any.

-- Is there some other way to install those packages while keeping the forwarder in a slim container?

0 Karma

sbarreig
New Member

Hello,
In have Splunk Enterprise as the Indexer and the Search Header, I´m triyng to collect performance data from a linux server so I installed in the server the Universal Forwarder and the Splunk_TA_nix Add On. I did the basics configuration to inputs.conf but at the end I didt collect the performance data like lsoft,top,nstats,etc.
How did you achive to collect netstat,top,ps?
Thanks

0 Karma

darrenfuller
Contributor

Do you have dev tools available? You could install sar from source. The source for it can be found at :

https://github.com/sysstat/sysstat

tar -xvf sysstat-12.1.4.tar.bz2
cd sysstat-12.1.4/
./configure --enable-install-cron
make
make install

0 Karma

leomeyerovich
Explorer

Unfortunately not - no make etc. either. AFAICT the official container won't work as a multi-stage build phase either. Looks like we may need to make an unofficial container 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...