Splunk Search

Health Check of Servers after patching

ravigaur06
Observer

Hi ,

 

I want to ask community how you do health check of servers after patching? Is there any automation you have build in order to identify if server health check is good after patching activity for multiple server in one shot? Using any tool to identify or any query build up or  any dashboard to enter the server details and get stats?

Labels (1)
0 Karma

dural_yyz
Builder

It's not clear if you are speaking about patching Splunk application servers or just other servers in your environment.  Any server hosting a Splunk function will report into the DMC and that should be your source of truth about how the Splunk application is functioning after a server patch.

Other servers in your environment should be monitored based upon your own desires and concepts of critical functions.  It really lays outside the topics on this community answer board.

0 Karma

ravigaur06
Observer

First of all sorry i am not clear about the servers. These are syslogs servers which we patch and we have list of server to validate if these are working perfectly fine post patching activity or not. Do you know or suggest what all things we can validate in one by creating any dashboard or some other type of automation?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well, if the servers themselves work OK - that's the task for the infrastructure team. They should have tools for that (or at least the knowledge what and how should be checked). You can discuss with them if Splunk can be helpful in this process but of course you'd need some data ingested from the relevant hosts.

If you just want to check if the servers send data which is ultimately ingested into splunk, there are several apps for that on Splunkbase, for example TrackMe.

0 Karma

ravigaur06
Observer

Thanks for an answer however i am looking for generic solution and don't want to using any App.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. There is no such thing as "generic solution" to a very broadly specified problem. It's as if you asked "how to make people happy? I want a generic solution". If you have a specific problem, we can try to help you find a specific solution.

2. If you don't want to use any ready-made apps, you have to implement such functionality yourself. Have a list of sources/hosts (either build it dynamically when your environment is running or create it from external data - for example export from your CMDB) and repeatedy verify if you have recent events ingested from those sources and hosts. That's it.

0 Karma

ravigaur06
Observer

Yes, This is what i am planing to do so. Thanks for the input.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...