Nmon Performance monitor Splunk app for Unix and Linux systems Documentation

132 Pages·2016·6.42 MB·English

Nmon Performance monitor Splunk app
for Unix and Linux systems
Documentation
Release 1.9.0
Guilhem Marchand
Nov 06, 2019

Contents
1 Overview: 3
1.1 AboutNmonPerformancemonitorforSplunk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Releasenotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 KnownIssues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.4 Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.5 Issuesandenhancementrequests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
1.6 ScriptsandBinaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
1.7 licence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
2 Documentation: 43
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
2.2 DeploymentMatrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
2.3 Deploymenttopologies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
2.4 Download. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
2.5 RunningonWindows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2.6 Deploytosingleserverinstance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
2.7 Deploytodistributeddeployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
2.8 DeployingNmonPerformanceMonitorinSHClusters . . . . . . . . . . . . . . . . . . . . . . . . . 65
2.9 DeploytoSplunkCloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
2.10 ManagingNmonCentralRepositories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
2.11 Eventgentesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
2.12 Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
2.13 SplunkHEC/nmon-loggerdeployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
2.14 rsyslog/nmon-loggerdeployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
2.15 syslog-ng/nmon-loggerdeployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
2.16 frameIDmappingmanagement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
2.17 Userguide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
2.18 TotalcostofOwnership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
2.19 Largescaledeploymentconsiderations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
2.20 ReferenceMaterials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
i
ii
NmonPerformancemonitorSplunkappforUnixandLinuxsystemsDocumentation,Release1.9.0
Nmon Performance is now associated with Octamis to provide professional solutions for your business, and
professionalsupportfortheNmonPerformancesolution.
Formoreinformation: Octamisprofessionalsupportforbusiness
Contents 1
NmonPerformancemonitorSplunkappforUnixandLinuxsystemsDocumentation,Release1.9.0
2 Contents
1
CHAPTER
Overview:
1.1 About Nmon Performance monitor for Splunk
• Author: GuilhemMarchand
• Firstreleasewaspublishedonstarting2014
• Purposes:
TheNmonPerformanceapplicationforSplunkimplementstheexcellentandpowerfulnmonbinaryknownasNigel’s
performance monitor. Originally developed for IBM AIX performance monitoring and analysis, it is now an Open
sourceprojectthatmadeitavailabletomanyothersystems. ItisfullyavailableforanyLinuxflavor,andthankstothe
excellentworkofGuyDeffaux,italsoavailableforSolaris10/11systemsusingthesarmonproject.
TheNmonPerformancemonitorapplicationforSplunkwillgenerateperformanceandinventorydataforyourservers,
andprovidesarichnumberofmonitorsandtoolstomanageyourAIX/Linux/Solarissystems.
Nmon Performance is now associated with Octamis to provide professional solutions for your business, and
professionalsupportfortheNmonPerformancesolution.
Formoreinformation: Octamisprofessionalsupportforbusiness
1.1.1 Splunk versions
ItisrecommendedtouseSplunk6.5.xorsuperiortorunthelatestcoreapplicationrelease.(indistributeddeployments,
onlysearchheadsmayhavethisrequirement)
ThelastreleasecanbedownloadedfromSplunkbase: https://splunkbase.splunk.com/app/1753
Compatibilitymatrixforcoreapplication:
3
NmonPerformancemonitorSplunkappforUnixandLinuxsystemsDocumentation,Release1.9.0
• CurrentmajorreleaseVersion1.9.x: Splunk6.5.xorsuperiorareofficiallysupported
Splunk6.4willgloballyperformasexpected,buttheremightbesomeunwantedbehaviorssuchascssissuesasthis
Splunkversionisnotsupportedanymorebythecoreapplication.
StoppedversionsforolderSplunkreleases:
• Last version compatible with Splunk 6.4.x with release 1.7.9 (Splunk certified): https://github.com/
guilhemmarchand/nmon-for-splunk/releases
• Last version compatible with Splunk 6.2.x with release 1.6.15 (Splunk certified): https://github.com/
guilhemmarchand/nmon-for-splunk/releases
• Last version compatible with Splunk 6.1.x, with release 1.4.902 (not Splunk certified): https://github.com/
guilhemmarchand/nmon-for-splunk/blob/last_release_splunk_61x
CompatibilitymatrixforTA-nmonaddon:
ConsulttheTA-nmondocumentation: http://ta-nmon.readthedocs.io
• Bothadd-onsarecompatiblewithanySplunkversion6.x(fullinstanceofUniversalForwarder)
TheTA-nmonadd-onisdesignedtobedeployedonfullSplunkinstancesorUniversalForwarders,itisonlycompat-
iblewithSplunk6.x.
The PA-nmon_light add-on is a minimal add-on designed to be installed on indexers (clusters or standalone), this
package contains the default “nmon” index definition and parsing configuration. It excludes any kind of binaries,
inputsorscripts,anddoesnotcollectnmondata.
1.1.2 Index time operations
Theapplicationoperatesindextimeoperations,thePA-nmon_lightadd-onmustbeinstalledinindexersinorderfor
theapplicationtooperatenormally.
IfthereareanyHeavyforwardersactingasintermediateforwardersbetweenindexersandUniversalForwarders,the
TA-nmonadd-onmustdeployedontheintermediateforwarderstoachievesuccessfullyindextimeextractions.
1.1.3 Index creation
TheNmoncoreapplicationdoesnotcreateanyindexatinstallationtime.
An index called “nmon” must be created manually by Splunk administrators to use the default TA-nmon indexing
parameters. (thiscanbetuned)
However, deploying the PA-nmon_light will automatically defines the default “nmon” index. (pre-configured for
clustersreplication)
Note:Theapplicationsupportsanyindexstartingwiththe“nmon*”name,howeverthedefaultindexfortheTA-nmon
inputsissetto“nmon”index.
In distributed deployments using clusters of indexers, the PA-nmon add-on will automatically creates the “nmon”
replicatedindex.
1.1.4 Summarization implementation
Accelerateddatamodels:
NmonforSplunkAppintensivelyusesdatamodelaccelerationinalmosteveryuserinterfaces,reportsanddashboards.
Splunkcertificationrequirementsprohibitthedefaultactivationofdatamodelsacceleration.
4 Chapter1. Overview:
NmonPerformancemonitorSplunkappforUnixandLinuxsystemsDocumentation,Release1.9.0
Sinceversion1.9.12,noneofthedatamodelsareacceleratedbydefault,thisisyourresponsibilitytodecideif
youwishtodoso,bellowaretherecommendedaccelerationparameters:
• metricsrelateddatamodelsacceleratedoveraperiodof1year
• nonmetricsdatamodelsacceleratedoverthelast30days(Nmonconfig,Nmonprocessing)
SplunkAccelerateddatamodelsprovideagreatandefficientuserexperience.
Acceleratedreports:
Thefollowingreport(s)usereportaccelerationfeature:
• VolumeofDataindexedToday,acceleratedforlast7days
• NumberofnotableeventsinDataProcessingorDataCollectsincelast24Hours,acceleratedforlast24hours
PleasereviewtheLargescaledeploymentconsiderationsdocumentation.
1.1.5 About Nmon Performance Monitor
Nmon Performance Monitor for Splunk is provided in Open Source, you are totally free to use it for personal or
professional use without any limitation, and you are free to modify sources or participate in the development if you
wish.
Feedbackandratingtheapplicationwillbegreatlyappreciated.
• JointheGooglegroup: https://groups.google.com/d/forum/nmon-splunk-app
• App’sGithubpage: https://github.com/guilhemmarchand/nmon-for-splunk
• Videos: https://www.youtube.com/channel/UCGWHd40x0A7wjk8qskyHQcQ
• Gallery: https://flic.kr/s/aHskFZcQBn
1.1.6 Open source and licensed materials reference
• cssmaterialsfromhttp://www.w3schools.com
• d3fromMichaelBostock: https://bl.ocks.org
• variousextensionsandcomponentsfromtheSplunk6.xDashboardExamplesapplication: https://splunkbase.
splunk.com/app/1603
• dark.cssfrom: http://www.brainfold.net/2016/04/splunk-dashboards-looks-more-beautiful.html
• Takethetourcomponentfromhttps://github.com/ftoulouse/splunk-components-collection
• hover.cssfromhttp://ianlunn.github.io/Hover
• freeofuseiconsfrom/www.iconfinder.com
• Javascript tips (inputs highlighting) from https://splunkbase.splunk.com/app/3171 - https://blog.octoinsight.
com/splunk-dashboards-highlighting-required-inputs
1.1. AboutNmonPerformancemonitorforSplunk 5
NmonPerformancemonitorSplunkappforUnixandLinuxsystemsDocumentation,Release1.9.0
1.2 Release notes
1.2.1 Requirements
• Splunk6.5.xandlaterOnly,for6.4.xandpriordownloadrelease: V1.7.9,forpriorto6.2.xdownloadrelease:
V1.6.15,for6.1.xandpriordownloadrelease: V1.4.902
• UniversalForwarderv6.xisrequiredforclients
• UniversalForwardersclientssystemlackingaPython2.7.xinterpreterrequiresPerlWITHTime::HiResmodule
available
1.2.2 What has been fixed by release
V1.9.20:
Version1.9.20
• fix: AIX - field alias for VP_Idle_PCT results in missing field after Splunk behaviour change regarding field
aliasingtononexistingfields#122
V1.9.19:
Version1.9.19
• fix: SolarisNMONANALYSERviewissuewithdrilldownfieldnamescausingURLmalformed#121
V1.9.18:
Version1.9.18
• fix: AIXlparmeasurementissueinsomequerieswhencomparingtocpu_all#118
• fix: Safecenter-userfeedbackonheadingscolor#119
V1.9.17:
Version1.9.17
• fix: JQuery vulnerability issue for the integrated viz addons (bullet chart amd radial meter, CVE-2016-
10707/CVE-2015-9251)#114
• fix: KVstorecollectionsmanagementinterfacesimprovements#115
• fix: Navimprovement: mergesearchandbuiltinmenuintosearchmenu#116
• fix: Nmonsummaryimprovement#117
V1.9.16:
Version1.9.16-multipleupdates#112
• reviewprops.confsourcetypesdefinitionforSplunkbestpractices
• updateofhorseshoe-meterandbullet-graphtotheirlatestversion
6 Chapter1. Overview: