- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- How does the SA_Syslog_collection app gather stats...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The app says that it needs to be installed on the indexers and the search heads, but how is the app to gather information (and perform the ' netstat -stu ' command mentioned in the docu) from the UF's without it being installed there as well?
I must be missing something simple.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Having a quick look at the inputs, its been designed to run netstat on the indexers, not the forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Having a quick look at the inputs, its been designed to run netstat on the indexers, not the forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's how it appears to me as well, though the app's documentation talks about using syslog-ng on UF's and how it can gather additional metrics on the UF's.. Bummer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I guess you cold configure the UF app to run the same script on the forwarders too?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmmm.. have a CRON job run the script and output it to a file that the UF watches... That is an idea!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I meant as a scripted input - then you can manage it from your deployment server, without having to resort to cron.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got it! That's a better idea, working on that now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Brilliant. That's working, thank you for the suggestion!
Note for anyone else who may have a Windows deployment server and a *nix UF - you'll have to check/change the file permissions / owner on the .sh file after deployment,
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
