I'm working on a solution to send metrics from a number of Linux servers running RHEL 7.5.
I've got collectd installed and sending data via an Http Event Collector. The issue is that no matter where I set the Interval setting, I'm still seeing metrics written every 10 seconds (the default according to https://collectd.org/documentation/manpages/collectd.conf.5.shtml#synopsis)
Has anyone run into this? I'm looking to set Interval to 300 seconds.
Interval 300 in /etc/collectd.conf and /etc/collectd.d/myApp.conf haven't done anything.
Hi jamessevenerlmco,
I don't see how this can be a Splunk question ¯\_(ツ)_/¯
but since you got my attention .... here we go 🙂
You are right in setting the Interval
option, remember it can be set globally or per plugin.
Have to run collectd -t
to test your config and more important have you run collectd -h
to get the information about the default config file location?
Because running it with collectd 5.7.1 tells me the default location of the config file is /etc/collectd/collectd.conf
not /etc/collectd.conf
.
Maybe this can helps as well https://github.com/collectd/collectd/issues/2444
If this all does not help you can always strace the pid and see which config file it really loads.
hope this helps ...
cheers, MuS
MuS, thanks for replying! You are correct, it's not directly a splunk question, but since it is the suggested way to get linux metrics into splunk, I thought I'd ask here.
On RHEL 7.5 running collectd 5.8.0, collectd -t and collectd -T return fine. -h tells me the default config file is /etc/collectd.conf
I've looked at that bug you linked, so I un-commented the interval line in /etc/collectd.conf, and set it to 300. (As it is set to 10 by default)
I've grep'd Interval in /etc/collectd.conf and /etc/collectd.d/* and looked for any other Interval settings that could override it, and there aren't any.
I do know it's using the correct config file, because all of my plugins are being loaded!
I'm leaning towards it's a bug in RedHat's release of collectd. I've got a ticket open with them. I'll update here.