Monitor /proc/meminfo in Splunk

[skrish91]

Hi,

I would like to monitor /proc/meminfo from my linux servers to get data such as virtual memory used and active memory being used. Is it possible to monitor the /proc/meminfo file using Splunk universal forwarder? I tried using the GUI and i dont get any data for the same. Please advise. Thanks.

[soskaykakehi · Accepted solution]

Hi @skrish91

You can use Splunk Add-on for Unix and Linux App.
This Add-on includes hardware.sh (supports meminfo) and easy to use.
https://splunkbase.splunk.com/app/833/

If you need customize or chooze specific fields, you can reuse hardware.sh or make your own shell scripts ( ex: using cat and awk commands and add a timestamp) .
Then, run your script with Script Inputs on the Universal Forwarder.

Monitor Inputs watch the files and open it. It does not fit to watch under /proc folder files.
/proc file is changing and overwrite realtime and there are no timestamp fields.