All Apps and Add-ons

What apps or add-ons should I use to monitor Linux machines?

infra2sec
Path Finder

Hi,

I have a little bit of experience working with Splunk in a Windows environment.

I have been tasked with identifying what the product can do it in a Linux Environment.

A cursory search revealed 3 apps/add-ons:

1) Splunk App for Unix and Linux

2) Splunk Add on for Unix and Linux

3) NMON Performance Monitor for Unix and Linux Systems

I also have very little practical experience with Linux. Could you tell me which I might want to use with Splunk?

My audience wants to know the potential of Splunk to monitor Linux systems in terms of Dashboards and I don't know where to start.

I have one Ubuntu Linux VM to play with.

Thanks!!

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi infras2sec, The nix addon / app are good places to start for basic OS related inputs and visualizations. Start with the addon, look through the inputs, and create a local inputs.conf with the stanza name for each input as you'd like, and set disabled=0 to override the default disabled=1. You also might want to override the default index assignment, although this has an impact on the saved searched the the visualizations use.

As a note, the nix app takes some study to get put in right, and to be made the most of.

Past the basic /var/log type monitoring, and whatever performance related metrics you are interested in getting (the addon has all this), you can then look at what specific applications you are interested in. Many of these sourcetypes are parsed out of the box. You can find a list here. http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Listofpretrainedsourcetypes

Apache webserver (and other webservers) come to mind. Past that you'll want to find apps for other specific softwares you're shop is running on linux.

Please let me know if this answers your question!

View solution in original post

johnmario
New Member

1.iostat
2.mpstat
3.netstat
4.nmon
5.strace

And also there are some more monitoring software https://www.hpe.com/us/en/insights/articles/16-linux-server-monitoring-commands-you-really-need-to-k... for further more assistance to this topic visit Data Recovery Dubai

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi Guilhem,

helped, thanks!

Cheers,
Alex

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi infra2sec,

Just saw recently this message, i wanted to add a comment but it didn't worked, so i am adding this is as an answer.
I am the author of the Nmon Performance application, and i wanted to add my own touch 🙂

If you are looking for a global monitoring solution for Splunk that comes with various views and interfaces to immediately get the best from your server stats, you should give a change to the Nmon App.

It is Splunk certified, easy to install and use, widely documented, the app will allow you to go deeper into an high level of system performance metrics with plenty of views and visualizations build from a production perspective.

You can have a look of some videos:

Presentation:
https://www.youtube.com/watch?v=yHlo0idH3is

Quick deployment demo:
https://www.youtube.com/watch?v=-0H-CJDIGDI

Don't hesitate if you have questions.

Guilhem

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi Guihem,

this app is sensational and extremely easy to install. Far the best app i've ever seen on Splunkbase.

Amazing Job!!!!!

Cheers Alex

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hello Alex !

I am very happy and glad you like it, that's much appreciated 😉
(feel free to add it some stars on Splunk base!)

Keep up with the news of it, the future main new version is already on the road and will implement the all new Splunk 7 metric store !

Cheers,

Guilhem

0 Karma

Spranta
Splunk Employee
Splunk Employee

Great news, thanks

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi Guilhem,

i've got one final Question. We are monitoring meanwhile 75 Linux Servers with your App, but one Host is filling the "notable events reported".

ERROR: hostname: xxxxxx Detected Bad Nmon structure, found ZZZZ lines truncated! (ZZZZ lines contains the event timestamp and should always begin the line)
ERROR: hostname: xxxxxx Ignoring nmon data

Do you have any Idea why?

Thanks
Alex

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi Alex,

That's weird indeed, If you can access the server, please run:

pkill nmon && rm -rf /opt/splunk/var/log/nmon

or

pkill nmon && rm -rf /opt/splunkforwarder/var/log/nmon

depending if this is a full / Universal forwarder instance, and correct the root path if youo have a non standard deployment.

(kill the running nmon binary and suppress the var log directory, within 1 minute a new process will be spawned and the directory structure re-created)

Apparently something went wrong, was the case for a long time ago or just the running process ? Which version of the TA please ?

Fell free to open an issue on https://github.com/guilhemmarchand/TA-nmon/issues if you like.

Guilhem

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi infras2sec, The nix addon / app are good places to start for basic OS related inputs and visualizations. Start with the addon, look through the inputs, and create a local inputs.conf with the stanza name for each input as you'd like, and set disabled=0 to override the default disabled=1. You also might want to override the default index assignment, although this has an impact on the saved searched the the visualizations use.

As a note, the nix app takes some study to get put in right, and to be made the most of.

Past the basic /var/log type monitoring, and whatever performance related metrics you are interested in getting (the addon has all this), you can then look at what specific applications you are interested in. Many of these sourcetypes are parsed out of the box. You can find a list here. http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Listofpretrainedsourcetypes

Apache webserver (and other webservers) come to mind. Past that you'll want to find apps for other specific softwares you're shop is running on linux.

Please let me know if this answers your question!

infra2sec
Path Finder

Thank you, I appreciate this. I am sure that I'll have to come back for more for help. I have a very close deadline unfortunately!

0 Karma

muebel
SplunkTrust
SplunkTrust

no problem, glad to help anytime. Did you mean to accept my answer? 😄

0 Karma

infra2sec
Path Finder

Yes, I intended to accept your answer. It is certainly acceptable at a high level!

ppablo
Retired

Converted and accepted 🙂 cheers

Patrick

0 Karma

infra2sec
Path Finder

I hate to ask in such a brute way....but for simple ease, would you select the app or the add on? Remember, I can hardly navigate my way around splunk or unix. 🙂

0 Karma

muebel
SplunkTrust
SplunkTrust

I'd start with just the add-on. It contains the inputs you need to get data off the system

0 Karma

infra2sec
Path Finder

I thought so. Makes sense. Thanks again.

0 Karma

infra2sec
Path Finder

I actually installed Splunk Enterprise on a Windows Server, but would like to monitor Linux clients.

I installed the Nix add-on and it has lots of buttons to play with, but I see an orange bar with the following message:

"This server is not running a known Unix or Linux operating system. Install this add-on on Unix or Linux systems only."

Did I goof here?

How can I monitor Linux Clients with a Windows installed version of Splunk?

Thanks

The following thread seems to allude to an answer, but it is generally Greek to me at this point:

https://answers.splunk.com/answers/237809/why-am-i-getting-this-error-trying-to-configure-th.html

0 Karma

muebel
SplunkTrust
SplunkTrust

To use the app for linux and unix, you'll need to have a Linux based search-head for it to be fully supported.

With that being said, you can still deploy the add-on (Splunk_TA_nix) and gather data from you nix hosts in the environment. If you are using a Windows based search-head, you won't be able to utilize the full app for nix, but you can still search over the data like any other data.

0 Karma

infra2sec
Path Finder

Thank you and well explained. All of the options are set to disabled. I can enable them, but the save button is greyed out and the changes are not saved. Should I assume that I can search nix clients in my environment? I could go ahead and try, but it would take me a few hours just to try and validate that assumption since I am not so great at searching.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi Infra2sec,

Just saw this post at the moment, so i wanted to add my own touch 🙂
I'm the author of the Nmon Performance app for Splunk.

I would off course advise you to take a look at the Nmon app if you are looking for a Performance monitoring solution for your Linux servers.

It is Splunk certified, easy to implement, widely documented, built from a Production perspective and provides easy to use and advanced dashboard that allow going deeper into your system performances.

Take a look at some recent videos:

Presentation:
https://www.youtube.com/watch?v=yHlo0idH3is

Deployment demo:
https://www.youtube.com/watch?v=-0H-CJDIGDI

Don't hesitate if you have questions.

Guilhrm

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...