Monitoring Linux - Metrics and Log Forwarding

Monitoring Linux brings your Linux servers into Splunk: the hosts your services run on, from RHEL and its rebuilds, Debian and Ubuntu to Fedora, Amazon Linux 2023 and SUSE, on amd64 and arm64. A service fails and systemd restarts it in a loop, and nobody notices. A host slows down, and nobody can tell whether it is CPU, memory pressure, I/O or one runaway process. A filesystem fills up, the connection tracking table fills and the kernel drops new connections, or security updates wait for weeks on a host nobody remembers. The answers sit in each host's journal and /proc, one host at a time. Monitoring Linux shows what Collectord forwards from each host. Collectord runs as a systemd service and sends the journal, the log files under /var/log and your applications' own log files to a Splunk events index, with the systemd unit of every journal entry and every process named, so a log line or a CPU spike is one search away from its service. It also reports the units in the failed state every minute and the pending package updates every hour. Host, process, network, filesystem and disk stats go to the same events index or to a Splunk metrics index, your choice: the app has a set of dashboards for each, and they look the same. The dashboards start from Hosts: one row per host with its CPU, memory, load and stall, and the alerts that fired. From there they go to one host in depth, its processes, the fleet's inventory and pending updates, the systemd services that failed, restart or were OOM-killed with their logs a click away, the network's interfaces, connections and listening ports, filesystems and disk I/O. Give each group of hosts a cluster name, such as prod or staging, and the dashboards and the Alert Catalog filter by it. Alerts come from an Alert Catalog of 45 templates, written for Splunk admins, the platform team, security and application teams. Each team picks the alerts it needs and creates them as its own saved searches, scoped to its own clusters. For Splunk Enterprise Security, the app maps SSH logins, sudo, host performance, inventory and pending updates to the Common Information Model. Install the collectorforlinux package on each host from our signed apt and yum repositories, or the tarball on any other distribution, set the HEC URL, token and license key in 002-user.conf, and enable the service. Upgrades keep your configuration. The app goes on your search heads, on Splunk Enterprise 9.2 or later or Splunk Cloud Platform. The app requires Collectord and a license key from Outcold Solutions. Evaluation and developer keys are free. Documentation: https://www.outcoldsolutions.com/docs/monitoring-linux/