overall splunk monitoring

[andersmholmgren]

What is needed to monitor that splunk is running properly.

There is the Deployment Monitor App (http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor) as well as the SoS app (http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk), but is that all that is needed?

Isn't there some kind of monitoring outside of splunk that is needed - e.g. monitoring that splunk processes (splunkd, splunkweb) are running? Any pointers around an overall monitoring strategy?

[MuS · Accepted solution]

Hi andersmholmgren

like any other IT system/server Splunk as well needs basic monitoring from the outside. a good start is for sure to monitor the two processes mentioned by you, but also keep in mind that there could be much more involved like SAN, NFS, network and so on.

hope this helps

cheers

[MuS]

Hi andersmholmgren

the most important process is the one you get with 'splunk status' listed as first, this is the main splunkd:

splunkd is running (PID: xxxxx).
splunk helpers are running (PIDs: xxxxx xxxxx).
splunkweb is running (PID: xxxxx).

other splunkd's are helpers and searches which makes no sense to monitor those - because as you said they come and go 😉

[shivang14]

Hi Mus,
How can we monitor the SBOX hosting Splunk environment ?
Can Splunk monitor its own OS and Hardware on which it is hosted ?
What is the best practivce to monitor SBOX ?
Regards
Shivang Kanoujia

[andersmholmgren]

Thanks MuS

Do you know of a good reference for the processes to monitor and their lifecycles?

I've noticed that splunkd instances seem to come and go if I'm not mistaken.

[shivang14]

Hi Mus,
How can we monitor the SBOX hosting Splunk environment ?
Can Splunk monitor its own OS and Hardware on which it is hosted ?
What is the best practivce to monitor SBOX ?
Regards
Shivang Kanoujia