monitoring few Websphere servers

[levisik]

Hi.

My company wants to implement Splunk as a main monitoring tool for logs.

We have something like 80 servers around our network.

We would like to monitor all those servers for syslog log files, but what is as important as syslog we would like to be able to check Websphere logs...

What would be the best solution to achieve that ?

One centralized splunk server - that's for start and I have it done.

What next ?

Shall I install universal forwarder on each box.

What about Websphere logs - how I can monitor them ??

Thanks for suggestions.

[levisik]

Is there any instruction how to do that ??

I mean - it is easy to deploy universal forwarder, but what next - how I can link it to main splunk server ?

[Damien_Dallimor]

A very simple approach would be to install a Universal Forwarder(UF) on each server.
Configure these UFs(WAS log files to monitor, syslog etc...) from your central Splunk server using Splunk's Deployment Server, and have the logs and syslog feeds forwarded to your central Splunk server.

You may also want to look at the Splunk for Websphere app selection on Splunkbase which provides a far more comprehensive monitoring solution, out of the box dashboards etc...

http://splunk-base.splunk.com/apps/search/?q=websphere&Submit=search