All Apps and Add-ons

Why .hprof dump is not created and TCP data is not seen in Splunk UI, even after configuration of Splunkagent.jar as stated in the documentation?

mahemars
New Member
0 Karma

Damien_Dallimor
Ultra Champion

Hprof dump files are not persisted.
They get temporarily created , then the binary hprof format is decoded into text and streamed to Splunk.
Then the temporary hprof dump file is deleted.

As to why you don't see data in Splunk , you are going to need to post some information to work off.

1) describe your environment
2) what setup steps have you performed
3) are there any error messages anywhere
4) what does your splunk agent configuration file look like
5) what other troubleshooting steps have you performed ? ie: can you see the data on the wire actually being sent to Splunk (using wireshark for example)

etc....

0 Karma

mahemars
New Member

Hi,
1) Environment: J2EE web application with Tomcat server, JDK1.7 . Application is running from Eclipse.
2) SetUp Steps: Splunkagent Jar is started with the start of Tomcat server. TCP port is configured as Directed in this link( http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Monitornetworkports) in the splunk UI.
Splunk UI Data Input:
(i) TCP Port:5150
(i) Source Type: Manual -TCP raw
More Settings:
(i) SetHost: Custom Value: PCname
Index: Default

Splunkagent.properties file configuration (changes) :
agent.app.name=Tomcat
agent.app.instance=jdk1.7.0_65
splunk.transport.tcp.host=splunkhost
splunk.transport.tcp.port=5150
3) No error messages were observed
4) Splunk configuration file:
agent.app.name=Tomcat
agent.app.instance=jdk1.7.0_65
(i) splunk.transport.tcp.host=splunkhost
(i) splunk.transport.tcp.port=5150
trace.whitelist=com/vogella
trace.blacklist=com/sun,sun/,java/,javax/,com/splunk/javaagent/
5) No, i didn't perform any troubleshooting

Note: I may have gone wrong in configuring Splunk properties file and Splunk UI settings marked with (i) above
I want to see the Method level statistics for those that are whitelisted in the splunk configuration file.

Thanks,

0 Karma

Damien_Dallimor
Ultra Champion

Your original question mention HPROF metrics , however in the response above you are now mentioned you want to see method stats.

Is "splunkhost" your actual hostname of your Splunk host ?

Please post your full configuration file.

0 Karma

mahemars
New Member

Hi,

yes, host name is splunkhost. ( should the "set host" be "splunkhost" in TCP Data-Input in Splunk UI)

Configuration file:

---------------------

Common Agent options

---------------------

agent.app.name=Tomcat
agent.app.instance=jdk1.7.0_65

agent.userEventTags=key1=value1,key2=value2

-------------------------

Splunk Transport options

-------------------------

splunk.transport.internalQueueSize=10000

splunk.transport.impl=com.splunk.javaagent.transport.SplunkTCPTransport

splunk.transport.impl=com.splunk.javaagent.transport.SplunkStdOutTransport

splunk.transport.tcp.host=splunkhost
splunk.transport.tcp.port=5150
splunk.transport.tcp.maxQueueSize=5MB
splunk.transport.tcp.dropEventsOnQueueFull=false

trace.whitelist=com/vogella
trace.blacklist=com/sun,sun/,java/,javax/,com/splunk/javaagent/
trace.methodEntered=true
trace.methodExited=true
trace.classLoaded=true
trace.errors=true

periodically dump hprof file(using JMX operation call), read in file & parse, send events to Splunk, delete file

trace.hprof=true
trace.hprof.tempfile=D:\344235\mydump.hprof

trace.hprof.tempfile=/etc/tmp/dump.hprof

in seconds

trace.hprof.frequency=10

Embedded JMX polling , all other JMX config is in the JMX XML configuration file.

trace.jmx=true

name of XML files(minus the ".xml" suffix) that should reside in the root of splunkagent.jar

trace.jmx.configfiles=jmx

trace.jmx.configfiles=goo,foo

in seconds

trace.jmx.default.frequency=20

trace.jmx.goo.frequency=30

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...