Nmon Performance Monitor Splunk App for Unix and Linux Systems Documentation Release 1.8.0
Total Page:16
File Type:pdf, Size:1020Kb
Nmon Performance monitor Splunk app for Unix and Linux systems Documentation Release 1.8.0 Guilhem Marchand October 07, 2016 Contents 1 Overview: 3 1.1 About Nmon Performance monitor for Splunk.............................3 1.2 Release notes...............................................5 1.3 Known Issues............................................... 30 1.4 Support.................................................. 30 1.5 Issues and enhancement requests.................................... 31 1.6 Scripts and Binaries........................................... 31 1.7 licence.................................................. 33 2 Documentation: 35 2.1 Introduction............................................... 35 2.2 Deployment Matrix........................................... 37 2.3 Deployment topologies.......................................... 39 2.4 Download................................................. 42 2.5 Running on Windows.......................................... 43 2.6 Deploy to single server instance..................................... 43 2.7 Deploy to distributed deployment.................................... 46 2.8 Deployment on Search Heads running in SH Pooling mode...................... 55 2.9 Deploying Nmon Performance Monitor in SH Clusters......................... 55 2.10 Deploy to Splunk Cloud......................................... 55 2.11 Managing Nmon Central Repositories.................................. 59 2.12 rsyslog / nmon-logger deployment.................................... 61 2.13 syslog-ng / nmon-logger deployment.................................. 69 2.14 Userguide................................................. 77 2.15 Total cost of Ownership......................................... 124 2.16 Reference Materials........................................... 127 i ii Nmon Performance monitor Splunk app for Unix and Linux systems Documentation, Release 1.8.0 Contents 1 Nmon Performance monitor Splunk app for Unix and Linux systems Documentation, Release 1.8.0 2 Contents CHAPTER 1 Overview: 1.1 About Nmon Performance monitor for Splunk • Author: Guilhem Marchand • First release was published on starting 2014 • Purposes: The Nmon Performance application for Splunk implements the excellent and powerful nmon binary known as Nigel’s performance monitor. Originally developed for IBM AIX performance monitoring and analysis, it is now an Open source project that made it available to many other systems. It is fully available for any Linux flavor, and thanks to the excellent work of Guy Deffaux, it also available for Solaris 10/11 systems using the sarmon project. The Nmon Performance monitor application for Splunk will generate performance and inventory data for your servers, and provides a rich number of monitors and tools to manage your AIX / Linux / Solaris systems. 1.1.1 Splunk versions It is recommended to use Splunk 6.5.x or superior to run the latest core application release. (in distributed deployments, only search heads may have this requirement) The last release can be downloaded from Splunk base: https://splunkbase.splunk.com/app/1753 Compatibility matrix for core application: • Current major release Version 1.8.x: Splunk 6.5.x or superior, see 03 - Additional upgrade notes - Migrating from release prior to Version 1.7.x Stopped versions for older Splunk releases: • Last version compatible with Splunk 6.4.x with release 1.7.9 (Splunk certified): https://github.com/guilhemmarchand/nmon-for-splunk/releases • Last version compatible with Splunk 6.2.x with release 1.6.15 (Splunk certified): https://github.com/guilhemmarchand/nmon-for-splunk/releases • Last version compatible with Splunk 6.1.x, with release 1.4.902 (not Splunk certified): https://github.com/guilhemmarchand/nmon-for-splunk/blob/last_release_splunk_61x Compatibility matrix for TA-nmon and PA-nmon technical add-ons: • Both add-ons are compatible with any Splunk version 6.x (full instance of Universal Forwarder) 3 Nmon Performance monitor Splunk app for Unix and Linux systems Documentation, Release 1.8.0 The TA-nmon add-on available in the resources directory of the core application is designed to be installed on Universal Forwarders end clients or Heavy Forwarders, it is only compatible with Splunk 6.x (Splunk 5.x and prior will not be able to extract fields definition from generated data, leading to the application being unable to analyse performance data) The TA-nmon_selfmode is an alternative version of the TA-nmon that does not use the “unarchive_cmd” feature of Splunk, instead of this, the package implements a script input that will monitor nmon files and call required operation. Unless you have an unexpected issue with Splunk (and the unarchive_cmd feature), the TA-nmon should be used. The PA-nmon add-on available in the resources directory of the core application is designed to be installed on indexers (clusters or standalone), it is compatible with Splunk 6.x (Splunk 5.x shall not be used as the App intensively uses data model acceleration which is not available in Splunk 5.x and prior) The PA-nmon_light add-on is an alternative version of the PA-nmon that is designed to be installed on indexers (clusters or standalone) that must not monitor performances (such as Splunk cloud indexers), this package only contains parsing configuration. It excludes any kind of binaries, inputs or scripts. 1.1.2 Index time operations The application operates index time operation, the PA-nmon add-on must be installed in indexers in order for the application to operate normally. In complex distributed deployments, Heavy Forwarders (which are full Splunk in- stances) can operate as intermediate collectors between indexers and Universal Forwarder clients, in such a case Heavy Forwarders with the TA-nmon add-on installed will operate index time parsing and will free indexers from these tasks. 1.1.3 Index creation Since the major release V1.7, the core application does not create anymore any index at installation time. An index called “nmon” must be created manually by Splunk administrators. In distributed deployments using clusters of indexers, the PA-nmon add-on will automatically creates the “nmon” replicated index 1.1.4 Summarization implementation Nmon for Splunk App intensively uses data model acceleration in almost every user interfaces, reports and dashboards. The application provides multiple data models that have the acceleration activated by default using “All time” as the time range limit. Because of the richness of Nmon monitors, and with large deployments, accelerated data model offers an improved user experience. Note that some minor scheduled reports that keep users informed of the application activity in home page uses standard acceleration. 1.1.5 About Nmon Performance Monitor Nmon Performance Monitor for Splunk is provided in Open Source, you are totally free to use it for personal or professional use without any limitation, and you are free to modify sources or participate in the development if you wish. Feedback and rating the application will be greatly appreciated. • Join the Google group: https://groups.google.com/d/forum/nmon-splunk-app • App’s Github page: https://github.com/guilhemmarchand/nmon-for-splunk 4 Chapter 1. Overview: Nmon Performance monitor Splunk app for Unix and Linux systems Documentation, Release 1.8.0 • Videos: https://www.youtube.com/channel/UCGWHd40x0A7wjk8qskyHQcQ • Gallery: https://flic.kr/s/aHskFZcQBn 1.2 Release notes 1.2.1 Requirements • Splunk 6.5.x and later Only, for 6.4.x and prior download release: V1.7.9, for prior to 6.2.x download release: V1.6.15, for 6.1.x and prior download release: V1.4.902 • Universal Forwarder v6.x is required for clients • Universal Forwarders clients system lacking a Python 2.7.x interpreter requires Perl WITH Time::HiRes module available 1.2.2 What has been fixed by release V1.8.0: CAUTION: For Splunk 6.5 and later (for prior versions of Splunk, see requirements below) Please review update notes: http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#additional-upgrade- notes-migrating-from-release-prior-to-version-1-7-x • Implementation of Splunk 6.5 auto refresh features • Minor improvements and evolutions for best Splunk 6.5 compatibility V1.7.9: Please review update notes: http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#additional-upgrade- notes-migrating-from-release-prior-to-version-1-7-x • Adding the PA-nmon_light add-on for indexers that need parsing configuration only (for people that do not want or must not monitor performance of indexers such as Splunk cloud indexers instances) • Documentation update V1.7.8: Please review update notes: http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#additional-upgrade- notes-migrating-from-release-prior-to-version-1-7-x • Add-ons update to 1.2.47 (Linux_unlimited_capture improvement #9, Nmon binary issue with SLES 11.3 #10) • Adding CONFIG df (filesystems stats) reports & dashboard V1.7.7: Please review update notes: http://nmon-for-splunk.readthedocs.io/en/latest/Userguide.html#additional-upgrade- notes-migrating-from-release-prior-to-version-1-7-x • Drilldown to inventory issues and improvements (Issue #55) 1.2. Release notes 5 Nmon Performance monitor Splunk app for Unix and Linux systems Documentation, Release 1.8.0 • Performance improvement of the TCO per server search (use datamodel for dcount) • Add-ons Perl parser (nmon2csv.pl) is lacking OStype field in raw data for TOP/UARG, causing data to be unavailable • Removal of nmon_inventory OStype mapping had removed OStype mapping for historical