Health Check of Servers after patching

[ravigaur06]

Hi ,

I want to ask community how you do health check of servers after patching? Is there any automation you have build in order to identify if server health check is good after patching activity for multiple server in one shot? Using any tool to identify or any query build up or  any dashboard to enter the server details and get stats?

[dural_yyz]

It's not clear if you are speaking about patching Splunk application servers or just other servers in your environment.  Any server hosting a Splunk function will report into the DMC and that should be your source of truth about how the Splunk application is functioning after a server patch.

Other servers in your environment should be monitored based upon your own desires and concepts of critical functions.  It really lays outside the topics on this community answer board.

[ravigaur06]

First of all sorry i am not clear about the servers. These are syslogs servers which we patch and we have list of server to validate if these are working perfectly fine post patching activity or not. Do you know or suggest what all things we can validate in one by creating any dashboard or some other type of automation?

[PickleRick]

Well, if the servers themselves work OK - that's the task for the infrastructure team. They should have tools for that (or at least the knowledge what and how should be checked). You can discuss with them if Splunk can be helpful in this process but of course you'd need some data ingested from the relevant hosts.

If you just want to check if the servers send data which is ultimately ingested into splunk, there are several apps for that on Splunkbase, for example TrackMe.

[ravigaur06]

Thanks for an answer however i am looking for generic solution and don't want to using any App.

[PickleRick]

1. There is no such thing as "generic solution" to a very broadly specified problem. It's as if you asked "how to make people happy? I want a generic solution". If you have a specific problem, we can try to help you find a specific solution.

2. If you don't want to use any ready-made apps, you have to implement such functionality yourself. Have a list of sources/hosts (either build it dynamically when your environment is running or create it from external data - for example export from your CMDB) and repeatedy verify if you have recent events ingested from those sources and hosts. That's it.

[ravigaur06]

Yes, This is what i am planing to do so. Thanks for the input.