in order to support huge modular input configuration xml strings when users want to run a very large number of inputs on 1 single instance of this app , we had to change the way that the child java process is invoked. Previously the xml string was passed as a program argument which could break the max argument size in the Linux kernel. Now we changed the logic to pass the xml string to the java process via the STDIN pipe.
The app performs periodic socket pings to the splunkd management port to determine if splunkd is still alive and if splunkd is not responding , usually because it has exited or is not network reachable, then the app self exits it's running java process.The default timeout is now 300 seconds. You can change this timeout value in bin/jmx.py by setting the SPLUNKD_TIMEOUT_SECS variable.
upgraded internal logging libraries to Log4j2 v2.17.2
upgraded internal logging libraries to Log4j2 v2.17.0
upgraded internal logging libraries to Log4j2 v2.16.0
upgraded internal logging libraries to Log4j2 v2.15.0
added a JSON Event formatter. See bin/config/examples/tomcat.xml
Setup Credentials menu tab and enter any JMX usernames/passwords you require.upgraded logging functionality
docs update
added a setup page to encrypt any credentials you require in your configuration
enforced python3 for execution of the modular input script.If you require Python2.7 , then download a prior version (such as 2.8).
updated all of the dashboards to be compatible with Splunk 8
removed the default 'jmx' index , 'main' is the new default index
Dual Python 2.7 and 3+ compatibility.
App will run on :
Splunk Enterprise versions back to Splunk 5 where there is only a Python 2.7 runtime shipped
Splunk Enterprise version 8 where there is both a Python 2.7 and Python 3+ runtime shipped
Future versions of Splunk Enterprise where there is only a Python 3+ runtime
added JAXB dependencies for JRE 9+
fixed Splunk 8 compatibility for manager.xml file
correcting some minor docs errors
cosmetic fixes
updated docs
added trial key functionality
docs updated
Added an activation key requirement , visit http://www.baboonbones.com/#activation to obtain a free,non-expiring key
Docs updated
Splunk 7.1 compatible
Minor HEC data handling tweaks
Added support to optional output to Splunk via a HEC (HTTP Event Collector) endpoint
Tidied up a dead link in the navigation menu
Fixed some minor typos
Enabled TLS1.2 support by default.
Made the core Modular Input Framework compatible with latest Splunk Java SDK
Please use a Java Runtime version 7+
If you need to use SSLv3 , you can turn this on in bin/jmx.py
SECURE_TRANSPORT = "tls"
Config file is now dynamically reloaded if it changes
PID File contents are read in on each poller execution
PID Command is executed on each poller execution
PID Command can also return JVM Descriptions in format : 1234,somedescription
Minor change so that when using "dumpAllAttributes" , only READABLE attributes will be polled.
Added a property to optionally specify an alternate config file directory location , relative to SPLUNK_HOME
Put app icon images in the correct directory(this has changed for Splunk 6)
Fixed a classloading clash for direct process attachment jars for win32 vs linux deployments
NOTE : As per Splunk legal naming standard requirements , this app has now been renamed from "Splunk for JMX" to "Monitoring of Java Virtual Machines with JMX". But it is still functionally the same with everything you know and love , plus more !
Release Features:
Refactored the core data collection to be a Modular Input vs the prior versions' scripted inputs.This is much better for performance as now you can run multiple polling stanzas in 1 single JVM, versus having to fire up a JVM for every time you execute a configuration file
As the Modular Input is a Python wrapper to a JVM instance , all Splunk platforms are now supported
The app can either be run in app mode(with dashboards) or in add-on mode(just the modular input.)
Removed all Advanced XML and replaced with Simple XML
Added support for listening for MBean Notifications
All logging now goes to splunkd.log , searchable via "index=_internal ExecProcessor jmx.py"
All documentation brought up to date.
Updated to be compatible with Splunk 6
Tweaked the GC views , Added support to roll out Composite Type arrays
When using direct process attachment and specifying a PID Command script, previously Splunk for JMX would only support a single PID in the command output , now it supports multiple PIDs (delimited by newlines)
Minor cosmetic update , removed paypal links
Added heap/non-heap memory committed charts to the jvm_memory dashboard
Added a setting to SearchSelectLister modules so that their populating searches inherit the parent TimeRangePicker selection
++added a configuration parameter(stripPattern) for Formatter declarations in config.xml that allows you to specify a regex pattern, or list of patterns, that if matched will strip the matched text from the raw MBean attribute/operations values++
++just a tweak to the build, some files were erroneously getting CHMOD'd executable in the tarball++
++Converted all the demo views to Advanced XML and added in dynamic time,host,jvm selectors++The new Advanced XML views use output generated by the TokenizedMBeanNameQuotesStrippedFormatter, this is the formatter now declared in the example config xml files, the DefaultFormatter is still available if you were using and still want to use that, but won't work with the new Advanced XML demo views++
++Refactored core engine so you can plugin both custom Formatters and custom Transports++Bundled STDout(default), Splunk Rest, TCP,Syslog,File Transport implementations++added ability to add parameters to Formatter and Transport declarations++3 bundled Formatters can be customised with various different parameters in the configuration xml file, such as the ability to prepend a date and specify the date format pattern++updated docs
Added a setup screen ++ Added a MAX_TIMESTAMP_LOOKAHEAD setting in props.conf to prevent erroneous epoch time rsolutions from non time fields ++ Added links in navigation bar to pdf/html docs
++minor adjustment to logging, no more daily rolling files , now only keeping 1MB with 1 backup as the JMX logs get indexed by Splunk anyway ++ documentation housekeeping
+++Added several new demo views, tables, charts...notably, CPU usage per JVM(based on the same algorithm that JConsole uses to derive the JVMs cpu usage), garbage collection, memory pools/memory managers , more thorough OS and Runtime metrics, enhanced connectivity errors page.+++no changes to core engine or config schema, so full backward compatibility maintained
Tweaked the demo forms and navigation bar >>Added a data input to monitor the splunk4jmx error logs and also added view on the navigation menu that reports on jmx connection errors.
Docs updated
Fixed minor bug in poll_mx4j_jmx.sh script
Added an optional "Formatter" implementation that rather than outputting the mbean name as a single canonical string, breaks up the mbean name into its constituent parts and outputs as individual fields.In your config XML file you can use this formatter by declaring.....<formatter className="com.dtdsoftware.splunk.formatter.TokenizedMBeanNameFormatter" />
Added support for discovering and extracting ALL attributes of an MBean.Provides an alternative to having to explicitly declare each attribute you want to extract.
...a few examples....
dump the attributes from every MBean from every domain :
<mbean domain="*" properties="*" dumpAllAttributes="true" />
....
dump the attributes from all MBeans in the java.lang domain :
<mbean domain="java.lang" properties="*" dumpAllAttributes="true"/>
...
dump the attributes from all MBeans in all of the cassandra domains :
<mbean domain="org.apache.cassandra.*" properties="*" dumpAllAttributes="true" />
MX4J support is now implemented, in addition to the standard JSR160 rmi and iiop connectors , there are now MX4J http/https connectors (hessian, burlap and soap). If your target JVM is using MX4J 3.0.2+ as its JMX implementation, then you can use these additional connectors.
In my testing, these http connectors all work well for simple attributes.
Hessian/Burlap work well with CompositeData attributes, but not so with TabularData attributes
Soap seems to have issues with CompositeData and TabularData attributes.
I would recommend the hessian connector if using an http based connector.
I have also updated the lib layout and scripts to allow easier addition of custom jar files, 3rd party jar files etc...
All documentation updated.
Tested against IBM J9 JVMs >>Fixed bug with multiple cluster elements in config xml file >> Tidied up processing of TabularData
Added more thorough Java Collection type support for Attribute value and Operation return types. >>>Can now deal with Arrays, Lists, Maps, Sets and recursively deeply inspect Collections of Collections.>>>Docs updated.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.