Incident investigation mac log files mac os x#
Incident investigation mac log files install#
Incident investigation mac log files upgrade#

Open a terminal window on the monitoring machine.Copy and paste the script into the command line of your hostĭeploy the script on your host to collect metrics and logs. The Docker socket is the UNIX socket Docker listens to for Docker API calls.Ģ. The default location of docker.sock is generally /var/run/. If you enabled Monitor Docker containers, enter the location of the Docker Socket.Collect OpenShift metrics and logs with Splunk App for Infrastructure.Collect Kubernetes metrics and logs with Splunk App for Infrastructure.If you want to monitor Docker containers you deployed with Kubernetes or OpenShift, see these topics: For requirements about running the script with Docker monitoring enabled, see Docker (no orchestration) data collection requirements. Metrics for Docker containers are merged with the host system so that the host system and Docker containers data displays as one entity in SAI. Enable this option to track Docker containers you did not deploy with an orchestration tool such as Docker Swarm, Kubernetes, or OpenShift. Enable Monitor Docker containers to collect metrics from Docker containers running on the host.If you're using Splunk Cloud, keep this option enabled. You may want to disable SSL if you're using self-signed certificates. curl doesn't trust self-signed certificates by default. Enable Use SSL to run the script with SSL.Enter the HEC token of the machine you want to send data to.

Incident investigation mac log files install#

For Forwarder location, specify the directory where you want the script to install the universal forwarder.

Enter the Receiver port of the machine you want to send log data to.

For HEC port, enter the port you use for the HTTP Event Collector (HEC) on the system you want to send metrics data to.

Enter the Monitoring machine hostname or IP address of the machine that has SAI installed.

You cannot delete the dimensions that the plug-in creates. The write_splunk collectd plug-in creates these five dimensions: Use the format of dimension:value, such as env:prod. Dimensions are key/value pairs that provide metadata about the metric (describes the measurement) used for searching and filtering relevant datasets (distinct time series) during an investigation.

Add Dimensions for easier troubleshooting, analysis, and filtering of entities.

When you are done selecting metrics and log sources, click Save.

If you select cpu > Collect sum over all CPUs, only aggregate metrics are stored for CPU usage.

If you select cpu > Collect data for each CPU, metrics are stored for each CPU core, which enables you to split CPU usage by each core in the Analysis Workspace.

The cpu and uptime metrics are selected by default, and cannot be deselected.

Click Customize to select the metrics and log sources you want to collect data for.

In the SAI user interface, click the Add Data tab and select OSX.

Select data collection options for collecting metrics and logs from your host.

Incident investigation mac log files upgrade#

For more information, see Install and configure the data collection agents on each applicable system in the Install and Upgrade Splunk App for Infrastructure guide. If you're running SAI on Splunk Cloud, you must enter specific settings for the Monitoring machine, HEC port, and Receiver port. For more information, see Send collectd data to a local universal forwarder.įollow these steps to configure and use the data collection script so that the host sends metrics and log data to SAI.

You can also configure collectd to send data to the universal forwarder instead of using the HEC. To create an HEC token, see Create an Event Collector token. You must be an administrator to configure data collection.

See Operating system support for data collection. Meet the following requirements to configure data collection: You can group your entities to monitor them more easily and further analyze your infrastructure by drilling down to the Overview Dashboard for entities only or the Analysis Workspace for entities and groups. Go to the Investigate page to monitor your entities in the Tile or List view.

Hosts you are monitoring are called entities. When you set up the data collection agent on your host machine, and validate new hosts are connected, you can start monitoring your infrastructure. To manually configure data collection, see Manually configure log collection on a *nix host for Splunk App for Infrastructure and Manually configure metrics collection on a *nix host for Splunk App for Infrastructure. If you are running Docker containers without an orchestration tool like Docker Swarm, Kubernetes, or OpenShift, you can use the script to monitor the Docker containers as well. You can forward metrics and log data to the Splunk App for Infrastructure (SAI) to monitor performance and investigate your infrastructure. Use the easy install script to install and configure data collection agents on a host you want to collect metrics and log data from.

Incident investigation mac log files mac os x#

Collect Mac OS X metrics and logs with Splunk App for Infrastructure