why do you have to NFS mount the NetApp ?

[fletch00]

Can someone clarify this step from the README?

"4. Create an NFS mount to the system partition of your filer(s). Copy local/inputs.conf.sample to inputs.conf and edit this file. Specify path to the system log path. For example:

[monitor:///opt/netapp_logs/10.160.114.230/etc/log]

"

Are we supposed to NFS mount the netapp to the splunk server?
what's the purpose of this step?

thanks

[halr9000 · Accepted solution]

On a 7-mode filer, there exists a log folder like many Unix-like OS'S: /etc/log. Here's a blog post that talks about some of the files there: http://rajeev.name/2010/04/15/log-file-locations-in-netapp-data-ontap/

There are two good ways to get to those logs: NFS mount the root volume, or use syslogd to write the messages to a network receiver (like Splunk), instead of, or in addition to, writing them to disk.

In the current version of this app, we are doing the former in order to populate the data on the top two panels of the default dashboard. It would not be hard to do the same via syslog. You just have to edit syslogd.conf on your storage controllers and send the alerts to Splunk (or a syslog server and then to Splunk, which many customers do). Then there would be a relatively small number of configuration changes to make these dashboard panels work as they do now via the NFS route. This is planned for a future revision of the app--we just didn't quite get there for 1.0.

Note that Cluster-mode has a managed way of configuring these things, so instead of editing syslogd.conf, you would execute something like "event destination modify -name allevents".

All that said, if you do not want to mount the filers, just skip that step. Some customers have said it would be hard to manage at scale or they do not do that by policy. Just understand what types of data you will be missing, and whether or not that is of value to you to have in Splunk, and lastly, if you want to get that data in a different way like syslog. If you fall into this case, I encourage you to use syslog, and to work with the data that way.

[halr9000]

@vchepkov if you don't mind, submit that as a new question tagged "Splunk App for NetApp ONTAP", please.

[vchepkov]

Would it be possible to list what changes need to be made to get data out of syslog instead of NFS share?

[gregbujak]

You can also use the UNC path:

[monitor://\\my_machine_name\c$\etc\log]

Make sure that the account you are running the forwarder under has access to the filer.