Getting Data In

What's the most efficient way to monitor JBoss log file activity?

suresh364
New Member

Sometimes we see our JBoss process running but really not functional. The indication is that the log file has not updated for a while. I have the following Splunk search to monitor the log for this condition. Is there any better way to track this ? Planning to run this every 5 minutes or so.

index=jboss_prod
| eval lastseen=strftime(_time, "%b %d %Y %H:%M:%S") 
| eval since=now()-_time
| rename last(lastseen) as "Last updated on"
| where since >210 
| search sourcetype=log4j
| table  host , source,lastseen,since 
| dedup  host , source 
| stats  last(lastseen) by host , source,since

Thanks in advance

Radhak

0 Karma

nickhills
Ultra Champion

Hi - I added this post - If you find it useful, please upvote the answer, or add your own solution if you found another way!

https://answers.splunk.com/answers/606762/how-do-i-monitor-jbosstomcatapacheetc-and-raise-an.html

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...