All Apps and Add-ons

cpu.sh not running with the interval

fuster_j
Path Finder

In my app

opt/splunk/etc/apps/cust_unix/local/inputs.conf I have these lines below, and I'm assume it will run every 5 sec. Seems like it'll run whenever it feel like, and no time pattern. How to debug this?

inputs.conf:
[script://./bin/cpu.sh]
sourcetype = cpu
source = cpu
interval = 5
index = os
disabled = 0

cpu.sh:
. dirname $0/common.sh

HEADER='CPU pctUser pctNice pctSystem pctIowait pctIdle'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-3s %9s %9s %9s %9s %9s\n", cpu, pctUser, pctNice, pctSystem, pctIowait, pctIdle}'

if [ "x$KERNEL" = "xLinux" ] ; then
queryHaveCommand sar
FOUND_SAR=$?
queryHaveCommand mpstat
FOUND_MPSTAT=$?
if [ $FOUND_SAR -eq 0 ] ; then
CMD='sar -P ALL 1 1'
FORMAT='{cpu=$(NF-6); pctUser=$(NF-5); pctNice=$(NF-4); pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$NF}'
elif [ $FOUND_MPSTAT -eq 0 ] ; then
CMD='mpstat -P ALL 1 1'
FORMAT='{cpu=$(NF-9); pctUser=$(NF-8); pctNice=$(NF-7); pctSystem=$(NF-6); pctIowait=$(NF-5); pctIdle=$(NF-1)}'
else
failLackMultipleCommands sar mpstat
fi
FILTER='/Average|Linux|^$|%/ {next} (NR==1) {next}'
elif [ "x$KERNEL" = "xSunOS" ] ; then
if [ $SOLARIS_8 -o $SOLARIS_9 ] ; then
CMD='mpstat -p 1 2'
else
CMD='mpstat -q -p 1 2'
fi
assertHaveCommand $CMD
FILTER='(NR<=2) {next} ($1 >= "0") {inBlock=1} (!inBlock) {next}'
FORMAT='{cpu=$1; pctUser=$(NF-4); pctNice="?"; pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$(NF-1)}'
elif [ "x$KERNEL" = "xDarwin" ] ; then
CMD='sar -u 1'
assertHaveCommand $CMD
FILTER='($0 !~ "Average") {next}'
FORMAT='{cpu="all"; pctUser=$2; pctNice=$3; pctSystem=$4; pctIdle=$5; pctIowait="?"}'
elif [ "x$KERNEL" = "xFreeBSD" ] ; then
CMD='iostat -C -c 2'
assertHaveCommand $CMD
FILTER='(NR<4) {next}'
FORMAT='{cpu="all"; pctUser=$(NF-4); pctNice=$(NF-3); pctSystem=$(NF-2); pctIdle=$NF; pctIowait="?"}'
fi

$CMD | tee $TEE_DEST | $AWK "$HEADERIZE $FILTER $FORMAT $PRINTF" header="$HEADER"
echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILTER $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST

0 Karma

mikelanghorst
Motivator

interval is generally in seconds unless you specify in crontab format:
interval = [|]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.
* Defaults to 60 seconds.

I'm not sure how the passAuth actually functions, but I would expect (since I'm not seeing additional information for configuring sudo) that it can't elevate it's priviliges, but only drop from root to another user. You could wrap it in another script to use sudo.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...