All Apps and Add-ons

What is the benefit of Splunk Add-on for Apache Web Access if it monitors the same source as Splunk Add-on for Unix and Linux?

bayman
Path Finder

I am a new Splunk user and have Splunk Add-on for Unix and Linux installed which is set to monitor /var/log on my Apache web server. I have the following questions I'm hoping to better understand:

  1. What value does installing Splunk Add-on for Apache Web Server have if /var/log/apache log files are already monitored by Splunk_TA_nix?

  2. Will logs from /var/log/apache be duplicated since both apps are creating different sourcetypes?

0 Karma
1 Solution

sjohnson_splunk
Splunk Employee
Splunk Employee

I don't believe you have to worry about any duplication. The Splunk_TA_nix app does monitor the /var/log directory but is pretty specific what it picks up (also note it is disabled by default):

[monitor:///var/log]
whitelist=(.log|log$|messages|secure|auth|mesg$|cron$|acpid$|.out)
blacklist=(lastlog|anaconda.syslog)
index=os
disabled = 1

Are the apache logs actually in /var/log or are they in a lower level subdirectory (httpd)? The monitor stanza above will not recurse down another level.

FYI - if there are multiple inputs.conf that end up monitoring the same file, only 1 will actually win. The precedence is the app that has the name with the lowest ASCII sort order will win.

View solution in original post

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

I don't believe you have to worry about any duplication. The Splunk_TA_nix app does monitor the /var/log directory but is pretty specific what it picks up (also note it is disabled by default):

[monitor:///var/log]
whitelist=(.log|log$|messages|secure|auth|mesg$|cron$|acpid$|.out)
blacklist=(lastlog|anaconda.syslog)
index=os
disabled = 1

Are the apache logs actually in /var/log or are they in a lower level subdirectory (httpd)? The monitor stanza above will not recurse down another level.

FYI - if there are multiple inputs.conf that end up monitoring the same file, only 1 will actually win. The precedence is the app that has the name with the lowest ASCII sort order will win.

View solution in original post

0 Karma

bayman
Path Finder

The apache logs are actually in /var/log/apache2/access.log. I actually enabled monitoring of the the /var/log on the Splunk_TA_nix app. Should I disable it if I am using the Splunk Add-on for Apache Web Access to monitor /var/log/apache2/access.log? I still would like syslog to be monitored.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Leave it on. You probably should always be monitoring the messages and secure logs.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!