Monitoring Splunk

OSSEC and SPLUNK... just stopped ?

jhuebner
Explorer

I've had both services running on the save Ubuntu 10.04 server for about a week. OSSEC is cooking along gathering information. And SPLUNK is happily displaying this data for easy quick high level viewing.

I did switch SPLUNK to the "free" license.

For days & days I've had good data. @ around noon yesterday, it started to taper DOWN...

06-18-2010 05:59:55.073 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371535, eps=3.741935, kb=73.517578 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options

I noticed today @ 6am data stopped. This was the last entry...

6/18/10 6:00:26.048 AM
06-18-2010 06:00:26.048 INFO Metrics - group=per_source_thruput, series="udp:10002", kbps=2.371220, eps=4.258065, kb=73.507812 host=lcua141 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/metrics.log Options

I'll start by looking at this splunk log...

Any suggestions/ideas appreciated!

Thank you!

JLH

0 Karma
1 Solution

jhuebner
Explorer

I got this going by running a re-install. apparently something got mad, but the reinstall fixed it.

JLH

View solution in original post

0 Karma

jhuebner
Explorer

I got this going by running a re-install. apparently something got mad, but the reinstall fixed it.

JLH

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...