Installation

What is the best way to install the Splunk Add-on for IBM Websphere Application Server to collect JMX data from WebSphere?

splunker_123
Path Finder

Hi

I'm looking to install Splunk Add-on for IBM WebSphere Application Server to get JMX data and WebSphere logs.

What is the best way of installing the Splunk Add-on and getting the JMX data from WebSphere?
Is deploying Add-on on each WAS server and getting the data out of it the only way we can achieve this, or is there any better way of getting this done?
I'm thinking to deploy Splunk Add-on in some central server and from there, it goes to all WebSphere nodes and collect data? I'm not sure what other complication there with this approach. Has anyone implemented this in a similar way or in any other architecture?

Please let me know your suggestions

Thanks

rpille_splunk
Splunk Employee
Splunk Employee

You should be able to collect the data locally or remotely using the Splunk Add-on for JMX, which is what the Splunk Add-on for WebSphere depends on to get JMX metrics data. The documentation for what you are describing is here: http://docs.splunk.com/Documentation/AddOns/latest/IBMWAS/Configureinputs

I hope that helps!

4Name
Explorer

Hi,

I am also interrested in setting up a splunk monitoring for websphere via this add-on.
It works out of the box in a local setup, giving the JMW plugin the local jmx's pid, but I am unable to get it to send me data in a distributed setup (Websphere and Splunk on two different servers), communicating by iiop/jndi as specified in the documentation...
I tried opening the firewall ports, editing /etc/hosts.conf with my Websphere server IP, but I'm still not able to get any data in Splunk.

Could you tell me what I'm missing please?
Thanks!

0 Karma

4Name
Explorer

The trick was to also enter in hosts file the local server's hostname (for some reason it was not configured...) and to connect with authentication.

But now I'm stuck again, I am able to connect to the my distant JMX server, but I don't seem to have the permissions to access the JMX Indicators and I get the following error for all my indicators : "javax.management.JMRuntimeException: ADMN0022E: Access is denied for the getStats operation on ThreadPool MBean because of insufficient or empty credentials."

Do you have any idea how to set the right rights in order to get the data I want? (I use LDAP authentication)

Thanks!

0 Karma

4Name
Explorer

I finally solved my problem using a RMI URL instead of IIOP, and putting the following parameters when launching my jvm :
-Dcom.sun.management.jmxremote.port=
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.ssl=false

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...