Host monitoring

[fisk12]

Hello I have just installed splunk on my work and have the firewalls and wireless stuff send syslog to it. Im also looking for some monitoring of the server. Now i wonder if its best to put on something like ossec and integrate it with splunk or use splunks own tool for monitoring servers? The same with nagios and have it send events with syslog to the splunk server or is splunks own tools for doing the same stuff as good?

[tgow]

Some things to keep in mind when making this decision:

1. Splunk is not a what engine (Nagios) but a "why" engine. You could easily write scripts that poll web sites and servers in Splunk but it makes more sense to let Nagios do this for you. Pull the data that Nagios has collected into Splunk and then analysis it for the "why" with all of your other data as well. There is an app for integration as well:

http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+Nagios

1. Splunk has the ability to collect data and send it to a central indexer. This configuration is called a forwarder. The forwarder can be installed on the *NIX/Windows/Mac systems and forward only the data you are interested in. There is also a *NIX/Windows app in Splunkbase that allows you to monitor these systems and the applications running on them.

http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+Unix+and+Linux

Hope this helps.

[fisk12]

Thanks! Yeah maybe its best to deploy both nagios and ossec and intergrate them with splunk to get the best out of it.