Splunk ITSI

I have Splunk app for infrastructure installed, how can I monitor services with with Windows and Linux client machines?

qhmassc
Explorer

I have Splunk app for infrastructure installed, how can I monitor services with Windows and Linux client machines?

0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

@qhmassc

For Linux/Unix, you can use collectd's "Processes" plugin and send processes metrics data to SAI.

Just update your collectd.conf file and add this plugin and restart collectd. You can find lot of info on how to add this plugin with a quick search.

qhmassc
Explorer

Thanks, I have processes plugin configured, and process "crond" is monitored, I can find crond process is listed in the Metrics. but how can I monitor this process is up and run? use ps_code, ps_rss...?

Thanks again.

0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

Sorry, I didn't completely get your follow-up question.
I guess once you configure collectd.conf and add all the processes you want to monitor, you should be able to see it in SAI Analysis page and you can monitor like setting up alerts?

0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

I tried it and understand your question now.

0 Karma

dagarwal_splunk
Splunk Employee
Splunk Employee

What I found is that when I stopped the process that I was monitoring , all the values like
name.ps_code/ps_data etc becomes 0 from positive value.

Maybe set an alert on any of this value to monitor it?

0 Karma

pwu_splunk
Splunk Employee
Splunk Employee

If you're referring to metric collection, when you click on the Add Data page, there will be a set of tabs on the left that lists the different types of client machines that you can collect from. Each tab has further information on how to collect data from that machine type. For further information, you can refer to this link [1].

If you're referring to the service concept in Splunk (e.g. [2]), SII does not support this at this time...

If you're referring to OS services / processes, you can refer to vishaltaneja07011993's answer.

[1] https://docs.splunk.com/Documentation/InfraApp/1.2.2/Admin/AddData
[2] https://docs.splunk.com/Documentation/ITSI/4.1.0/Configure/CreateService

0 Karma

vishaltaneja070
Motivator

Hello @qhmassc

For Monitoring Windows services, there is no need of any app. Directly use the below link which can help to monitor windows service:

https://www.splunk.com/blog/2014/05/30/monitoring-windows-service-state-history.html

And in Linux we need to monitor processes , so for you can use Splunk App for Linux and Unix. This supports a ps data input which you can use to monitor processes.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...