I have Splunk app for infrastructure installed, how can I monitor services with with Windows and Linux client machines?

[qhmassc]

I have Splunk app for infrastructure installed, how can I monitor services with Windows and Linux client machines?

[dagarwal_splunk]

@qhmassc

For Linux/Unix, you can use collectd's "Processes" plugin and send processes metrics data to SAI.

Just update your collectd.conf file and add this plugin and restart collectd. You can find lot of info on how to add this plugin with a quick search.

[qhmassc]

Thanks, I have processes plugin configured, and process "crond" is monitored, I can find crond process is listed in the Metrics. but how can I monitor this process is up and run? use ps_code, ps_rss...?

Thanks again.

[dagarwal_splunk]

Sorry, I didn't completely get your follow-up question.
I guess once you configure collectd.conf and add all the processes you want to monitor, you should be able to see it in SAI Analysis page and you can monitor like setting up alerts?

[dagarwal_splunk]

I tried it and understand your question now.

[dagarwal_splunk]

What I found is that when I stopped the process that I was monitoring , all the values like
name.ps_code/ps_data etc becomes 0 from positive value.

Maybe set an alert on any of this value to monitor it?

[pwu_splunk]

If you're referring to metric collection, when you click on the Add Data page, there will be a set of tabs on the left that lists the different types of client machines that you can collect from. Each tab has further information on how to collect data from that machine type. For further information, you can refer to this link [1].

If you're referring to the service concept in Splunk (e.g. [2]), SII does not support this at this time...

If you're referring to OS services / processes, you can refer to vishaltaneja07011993's answer.

[1] https://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/AddData
[2] https://docs.splunk.com/Documentation/ITSI/4.1.0/Configure/CreateService

[vishaltaneja070]

Hello @qhmassc

For Monitoring Windows services, there is no need of any app. Directly use the below link which can help to monitor windows service:

https://www.splunk.com/blog/2014/05/30/monitoring-windows-service-state-history.html

And in Linux we need to monitor processes , so for you can use Splunk App for Linux and Unix. This supports a ps data input which you can use to monitor processes.