NMON Performance Monitor for Unix and Linux Systems: After configuration, why did the forwarder stop sending data after 2 hours?

[zahirfusion]

Hi,

I have issue in implementing the Splunk for nmon App. In my forwarder I have the TA-nmon. After successful configuration, I only received the data for 2 hours. After that, no more data was being sent to the Indexer. I'm totally lost and don't know which area I need to check. Glad if someone can help me on this.

Thank You.

[zahirfusion]

Hi @guilmxm sorry for the late reply. After i follow the steps that you provide me below, I only able to get the nmon_data about 5 minutes only. After that my nmon_data stop sending the data to indexer. But on the other sourcetype example nmon_collect,nmon_processing, nmon_clean all follow the realtime date. I'm not sure why nmon_data stop sending the data after it running for few minutes. I'm running the sarmon for spac T servers. Solaris 11 (11.2 sun4v sparc sun4v). This make me really confuse 😞

Appreciate your help on this.

[guilmxm]

Can we exchange by mail ?
You'll find my contact in the App help page (marker icon on home page)

[zahirfusion]

Hi @guilmxm I could not find your email address. Can you ping me first at this address zahir@fusiondatasb.com

[guilmxm]

Hi,

2 hours is the default duration of an Nmon instance wich generates performance data, that means that for some reason the forwarder did not restarted a new Nmon instance.

Can you verify:

In Splunk, go in search and look for events in:

index=nmon sourcetype=nmon_collect

--> These are the events from Nmon data collect, every minute the nmon_helper.sh should be called by Splunk, if no Nmon instance is found running, it is expected to relaunch the Nmon binary on the forwarder

There should be events for your forwarder, in normal circumstances and when Nmon instance is found you will see messages like:

Nmon is running (PID 1854)

When Nmon is not running, it should be launched with such type of event:

starting nmon :
/opt/splunkforwarder/etc/apps/TA-nmon-python/bin/nmon_x86_64_linux
-f -T -d 1500 -s 60 -c 120 in /opt/splunkforwarder/var/run/nmon/var/nmon_repository

You can also look for splunkd events of your forwarder, with searches like:

index=_internal sourcetype=splunkd nmon

One question, in your deployment configuration (in the App configuration), have you set (like the doc says) "Enable App, Restart Splunkd" ?

It looks like not, and it looks like the nmon_helper.sh input script is not activated, ensure you set splunkd to restart in your deployment configuration.
If you hadn't, you can uninstall the App from the deployment console, set the correct config and redeploy.

OR you can just manually restart the forwarder.

Let me know

Guilhem

[ppablo]

Hi @zahirfusion

Make sure to tag your post with the official tag (greenish blue tag) for an App or Add-on you're referencing in your post. That way, the developer will get a notification that you asked a question about it. I just edited your post for you so @guilmxm should see this soon. He's awesome and very responsive on Answers 🙂

[guilmxm]

@ppablo: Thank you 🙂