All Apps and Add-ons

SoS - Debian Install - Not showing any CPU results

ukpbz
Explorer

Hi

I am running SoS on a Debian install. I have systat loaded but when I try and view cpu/memory util, I get the no results 'inspect' show

Any ideas?

Thanks

1 Solution

hexx
Splunk Employee
Splunk Employee

You need to enable the 'ps_sos.sh' scripted input for that view to populate. Take a look at this Splunk Answer for details on how to do this.

View solution in original post

hexx
Splunk Employee
Splunk Employee

You need to enable the 'ps_sos.sh' scripted input for that view to populate. Take a look at this Splunk Answer for details on how to do this.

hexx
Splunk Employee
Splunk Employee

Issues with 'lsof_sos.sh' have been reported lately, but we haven't had the opportunity to dig deeper into them or reproduce the problem in-house yet. You may want to look up that Splunk Answer I just linked and use the work-around provided if you find out that manually running $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/sos/bin/lsof_sos.sh yields no output.

0 Karma

ukpbz
Explorer

Actually that still didn't fix the file descriptor usage view 😞

0 Karma

ukpbz
Explorer

Many thanks.....

Now you have mentioned it, when I click Sos -> Resource Usage -> File Descriptor Usage - it falshes up a screen for a second and I saw that file name lsof_sos.sh in bold but didn't have time to read the text around it before the usage page loaded.

I enabled all the scripts in the manager for sos in the end

Thanks

hexx
Splunk Employee
Splunk Employee

For file descriptor usage, you need to enable 'lsof_sos.sh'. You'll find these requirements explained in the README file of the app or in the "Learn More" panel of the respective views. We always point out post-installation actions needed to enable a view in that panel 🙂

0 Karma

ukpbz
Explorer

Many Thanks, That worked.

Is there a list of what scripts need enabling as the same thing happens with file descriptor usage

Thanks

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...