All Apps and Add-ons

nmon2csv.py doesn't work on python 2.7.9

adepasquale
Path Finder

when using python, the host gets inventoried but never sends any perfdata. I realized the difference between this host and a working host was that this host used python over perl.

I edited nmon2csv.sh and nmon_cleaner.sh to look for version 2.9 instead (arbitrary higher version number). Everything works fine using pearl, except that i can't get config data. EDIT: since i wiped all data from the index but left the old config time stamps it looks like i'll have to wait about an hour before it sends another config.

I'm running the latest version of everything.

0 Karma
1 Solution

guilmxm
SplunkTrust
SplunkTrust

Hi,

Following our exchanges, I have been able to identify the root cause of this issue which affects only servers running Oracle Solaris 10 and having Python interpreter 2.7.x available.

For some strange reasons, on this system, the comparison between two integer won't work if not explicitly set as integer: int(xxxx)

As such, the realtime mode in nmon processing uses data checkpoint and manipulates epoch time to extract performance data to be indexed in Splunk, the following change has been required:

if ZZZZ_epochtime > last_epoch_filter:

To:

if int(ZZZZ_epochtime) > int(last_epoch_filter):

A new release of the core application (1.8.1) will be soon available including Technical addons in version 1.2.48

The TA-nmon addon has been already updated on Splunk Base and you can download the last version which solves this issue: (this release will be set as the default one when the core application release will have been certified)

To access the new release, go to the application page in Splunk base and select the version at bottom of the page.

Guilhem

View solution in original post

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi,

Following our exchanges, I have been able to identify the root cause of this issue which affects only servers running Oracle Solaris 10 and having Python interpreter 2.7.x available.

For some strange reasons, on this system, the comparison between two integer won't work if not explicitly set as integer: int(xxxx)

As such, the realtime mode in nmon processing uses data checkpoint and manipulates epoch time to extract performance data to be indexed in Splunk, the following change has been required:

if ZZZZ_epochtime > last_epoch_filter:

To:

if int(ZZZZ_epochtime) > int(last_epoch_filter):

A new release of the core application (1.8.1) will be soon available including Technical addons in version 1.2.48

The TA-nmon addon has been already updated on Splunk Base and you can download the last version which solves this issue: (this release will be set as the default one when the core application release will have been certified)

To access the new release, go to the application page in Splunk base and select the version at bottom of the page.

Guilhem

0 Karma

adepasquale
Path Finder

That's what I call service.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hello,

Python 2.7.9 is confirmed to work with no issues that would be involved by this particular Python version.
To troubleshoot the issue, please have a look at the troubleshooting guide:

http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#troubleshooting-guide-from-a-to-z

The easy way to troubleshoot would be to:

  • stop the forwarder:

    /opt/splunkforwarder/bin/splunk stop

  • run a manual test with some previously cleaning operations:

clean:

rm -rf /op/splunkforwarder/var/log/nmon

start nmon process:

/opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/TA-nmon/bin/nmon_helper.sh

Wait at least 1 minute to have perf data, then run:

Replace with the name of the nmon file.

cat /opt/splunkforwarder/var/log/nmon/var/nmon_repository/<nmon_file> | /opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.py --mode realtime

The output should contains information about any issue that would be encountered by the Python script.

Please send me the output and I would be able to identify the root cause of this issue, you can contact me by email from the app main page in Splunk base.

You will find additional explanations in the trouble shooting guide.

Thank you for your help.

Guilhem

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hello !

Ok, very interesting, I will verify this and will come back to you as soon as possible.

The nmon_config data will never be generated less than every hour (as it looks the nmon2csv.py did part of the job that managed this)
You can force this however by deleting the directories in $SPLUNK_HOME/var/log/nmon and killimg the current nmon process, on next occurrence the config data will be generated and indexed.

Any way, I will check the Python compatibility issue, could you:

  • Give me OS Linux and version of that server ?
  • Look for Python error you probably had in splunkd.log

Thanks !

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Update: I intensively tests most flavour of Linux, running on any 2.7.x has never been an issue.

My guess is that the problem you have comes from elsewhere than the Python version only, could you run the trouble shooting guide and send me logs:

http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#troubleshooting-guide-from-a-to-z

You will find steps to manually run the nmon2csv.py, which should give us errors you may encounter.

Thanks

0 Karma

adepasquale
Path Finder

I ran all the troubleshooting steps which is how I arrived at my conclusion. When running the python code manually, the first few lines were okay but then the output started producing binary garbage to stderr (which wasn't being logged).

The OS is Oracle Solaris 10 (latest patch) using the SPARC CPU architecture. I will try this on another machine running that same version of python on the same architecture but unfortunately, I'll have to get approval.

Also for what ever reason, this host in question is not working for alerting disk space over 90%. If i run it in search it comes up but not when i run the alert.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...