website monitoring

[vumanhtai]

Hi Splunk Team!
i want to running app website monitoring in splunkforwarder
how can i dot it
ThankS!

[jwiedow · Accepted solution]

Ok, this makes sense now. We have a similar setup and need to monitor nodes behind a load balanced VIP. Do you have a test page on your web server nodes that you are able to do a test with and does that page identify which node it is? You don't need this it just makes it helpful.

There is no need to install website_monitoring or website_input on each individual node. Have your existing HF monitoring the VIP monitor the individual nodes as well using the page I mentioned above. I don't know what your network topology is so I don't know if you will need to add firewall rules or routing changes to allow your HF to check the individual nodes. Make sure these rules or routes are in place as well.

website_monitoring is capable of handling 100's of connections and tests at the same time.

[vumanhtai]

Hi jwiedow
1 HF wants to check 1 node among many nodes running the same website, it will have to use the hosts file, so at the same time it is impossible to check multiple nodes because the hosts file cannot be changed at the same time.

[jwiedow]

@vumanhtai , I don't know your network setup nor your application architecture so it is difficult to comment on why you have the HF setup to only check one node and why it can't check more than one node at a time.

It sounds like you have some technical restrictions that would prevent you from using a single HF to check multiple nodes as well as the VIP. I would recommend working with your network and infrastructure team and explain what you are trying to do and if they have recommendations.

You can install Splunk Enterprise as a HF on your individual server nodes and then install Website_Monitoring on each node and have the nodes check themselves via the localhost or server name. I still would not recommend this as this is a lot of additional overhead and complexity to manage.

[jwiedow]

@vumanhtai, are you asking about running Website Monitoring on a device using the Unviersal Forwarder? I would not recommend doing and instead use a Heavy Forwarder. There are two reasons I caution against using a UF.

1. Python is not installed with the Splunk UF by default and Website Monitoring relies on Python for its functionality.
2. Resources needed for Website Monitoring can be high depending on how many sites you are planning on monitoring. You will want to have a server with enough CPU and RAM to support the number of connections and sites to be monitored.

Is there a specific use case you are wanting to use the UF for instead of a HF?

[vumanhtai]

Hi jwiedow
Currently 10 webapp server have 1 VIP IP and monitored through HF. So when the issue happen we dont know which particular node is the cause.
Also, all 10 servers are installed UF.
The question is: Can I make each server monitor its own website with its own UF?
Thank you