About JasonCzerak

JasonCzerak · ‎11-07-2012

Does this app have the ability to resolve IPs to DNS names prior to sending them off to the syslog server?

JasonCzerak · ‎11-01-2012

Bump to the top please.

JasonCzerak · ‎10-17-2012

I haven't anything pertaining to setting this up in a distributed environment. If i missed the docs can someone point me to them? If there is not anything that details any tips/trick, does anyone have any experiences with this? I haven't installed it yet, just trying to figure out if I'm going to waste my time or not 🙂

JasonCzerak · ‎09-04-2012

09-04-2012 00:10:36.644 -0500 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying... 09-04-2012 00:10:37.836 -0500 INFO TailingProcessor - ...continuing.

JasonCzerak · ‎09-04-2012

For one of the data sources, I have, and it works just fine with about 100,000 files. It's when I added several other data sources it broke down. I do have these errors in splunkd.log that I've just noticed: 09-04-2012 03:06:06.730 -0500 INFO TailingProcessor - File descriptor cache is full (100), trimming...

JasonCzerak · ‎09-03-2012

Is there a max file count a single forwarder can monitor? I have some oracle applications that generate 10,000's of new files daily, various sizes. I have a dedicated host that has these shared mounts mounted up and just scanning for new data. Every how and again it crashes the box. I can't seem to make anything out on the console. Am I running into some sort of file limit?

JasonCzerak · ‎03-23-2012

Has anyone figured out how to monitor /dev/console?

JasonCzerak · ‎03-21-2012

I have the same problem. The forwarders are on the same subnet as the intermediate forwarder. With just as little as 10 connections to it would error out.

JasonCzerak · ‎03-09-2012

No, I ran into that problem with the memory. This is a different problem. I think it's intended. The solution should very well be to prevent normal users from accessing the summary page.

JasonCzerak · ‎03-02-2012

So I'm at a loss here. .bashrc and .bash_profile are picked up just fine. however I can't get authorized_keys2 to be picked up unless I do something like /root/.ssh/* I wish to avoid known_hosts. I've tried just about everything can think of. What's weird is /root/.ssh/authorized_keys2 it self fails. Ideas? [fschange:/root/] filters = root_wl,all_bl fullEvent = true [filter:whitelist:root_wl] Key root files that should never change regex1 = [^/]authorized_keys2 regex2 = [^/].bash_profile regex3 = [^/]*.bashrc [filter:blacklist:all_bl] regex1 = .?

JasonCzerak · ‎03-01-2012

When ever a browser has the summary page loaded, there is a tremendous amount of IO. What exactly is this IO to/from? With out taking a huge dive into it, I know it's outbound IO and it's mostly "other" type of requests, like opening files and updating file system meta data. The Splunk file structure is NFS mounted. If I have too I could pull this data local to the OS with hopes the local file system caching could deal with these quests better on a normal file system.

Posts	11
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎10-18-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Resolving DNS in NetFlow output

Distributed environment configurations

splunk forwarder maximum monitored file limit?

monitoring /dev/console /dev/tty

fschange monitoring /root/.ssh/authorized_keys2

Search head summary page - Lots of IO.

Resolving DNS in NetFlow output

Re: Distributed environment configurations

Distributed environment configurations

Re: splunk forwarder maximum monitored file limit?

Re: splunk forwarder maximum monitored file limit?

splunk forwarder maximum monitored file limit?

monitoring /dev/console /dev/tty

Re: ERROR TcpInputProc - Error encountered for con...

Re: Search head summary page - Lots of IO.

fschange monitoring /root/.ssh/authorized_keys2

Search head summary page - Lots of IO.

Are you a member of the Splunk Community?