Splunk App for Unix and Linux: How are other users handling operating system metrics monitoring with Splunk?

[daniel333]

All

Curious how everyone is handling Operating system metrics monitoring with Splunk? Someone have blogs/conf talks/ or just general thoughts they want to share on this?

We are currently using Foglight for our operating system monitoring. Over all no one is happy with it, but OS and Vmware and MySQL monitoring are usable. But we started looking at Splunk for our operations needs.

Splunk for Unix -
It has been pretty helpful. But dollar for usage it's probably the most expensive source in our Splunk infra. When I tested it recently, even with some seriously reduced and disabled collection intervals, I ended up with over a 1tb of data consumed.

At the end of the day, I really just want to make it easier for my user to monitor things. Right now, having 4-5 platforms is just too much work for the users. Input and comments welcome and needed!

[guilmxm]

Hello,

Give a try to nmon !

https://splunkbase.splunk.com/app/1753

Nmon is very rich, compatible with AIX, Linux and Solaris for every architecture (power, x86, sparc... Even arm and ZLinux)

The cost per server is small, about 10-30 mb per machine (for bigger servers)

Nmon is well known to offer an high level of system expertise, and Splunk offers the power 😉

[daniel333]

Looks goods on paper. All CIM for interacting with other apps?

[guilmxm]

It is, Nmon app implements Performance, Application State, Inventory and Network CIM models.