All Apps and Add-ons

Can the TA-nmon app read externally generated nmon data on AIX?

michaeljlancast
Explorer

I was able to easily get this working on Linux to read nmon logs generated from cron. However, it is not working on AIX. I do see the splunkd.log where it appears to be reading the .nmon files once they stop being written to. Nothing every gets to the indexers, and the fishbucket seek pointer for the .nmon file remains at 0.

0 Karma

guilmxm
Influencer

Hi,

Not sure I have tested it from an AIX host but that should work yes.
If you are managing nmon data out of the TA context, you need to explicitly setup a colddata mode in a local/nmon.conf you deploy:

nmon2csv_options="--mode colddata"

https://ta-nmon.readthedocs.io/en/latest/nmon_config.html?highlight=nmon.conf

I do not recommend this kind of setup, the TA-nmon generates its own nmon data by writing to and reading from a fifo file to avoid processing costs and resources overhead, if you use the TA in this context you must ensure that nmon files provided for inputs are closed and not written anymore, which obliviously means being in most of the case with data at less -1.
I have people that continue to manage their own collection to be able to use alternative analysis which is fine, letting the TA generates its own data does not costs much to the server as the nmon (or topas-nmon) binary cost itself is very minimal.

Guilhem

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...