######################################### About the Metricator for Nmon application ######################################### * **Author:** Octamis limited U.K - Guilhem Marchand * **Purposes:** The Metricator for Nmon application for Splunk implements the excellent and powerful nmon binary known as Nigel's performance monitor. Originally developed for IBM AIX performance monitoring and analysis, it is now an Open source project available to many other systems. It is fully available for any Linux flavor, and thanks to the excellent work of Guy Deffaux, it also available for Solaris 10/11 systems using the sarmon project. The Metricator for Nmon application stack for Splunk generates performance and inventory data for your servers, and provides a rich number of monitors and tools to manage your AIX / Linux / Solaris servers. -------------------- Splunk compatibility -------------------- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Technical addons compatibility ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ **There are currently 2 versions of the technical addon which have different compatibility requirements:** TA-metricator-for-nmon ====================== The TA-metricator-for-nmon addon uses regular file monitoring for forward events and metrics to the Splunk infrastructure, it is compatible with: +--------------------------------------------+----------------------+ | Metricator for Nmon stack | Major version branch | | | | +============================================+======================+ | Splunk Universal Forwarder 7.x, 8.x | Version 1.1.x | +--------------------------------------------+----------------------+ TA-metricator-hec-for-nmon ========================== The TA-metricator-hec-for-nmon addon uses the Splunk HTTP Event Collector (HEC) to forward metrics and nmon data events, it is compatible with: +--------------------------------------------+----------------------+ | Metricator for Nmon stack | Major version branch | | | | +============================================+======================+ | Splunk Universal Forwarder 6.x, 7.x, 8.x | Version 1.1.x | +--------------------------------------------+----------------------+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Front-end and indexing components compatibility ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ **The Metricator for Nmon front-end application "metricator-for-nmon" and the Support Addon for indexing "SA-metricator-for-nmon" are compatibles with:** +--------------------------------------------+----------------------+ | Metricator for Nmon stack | Major version branch | | | | +============================================+======================+ | Splunk 7.x, Splunk 8.x | Version 1.1.x | +--------------------------------------------+----------------------+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ITSI module for Nmon Metricator ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ **The ITSI module for Nmon Metricator provides builting KPIs, entity import, service template and host health views:** +--------------------------------------------+----------------------+ | Metricator for Nmon stack | Major version branch | | | | +============================================+======================+ | Splunk 7.x, Splunk 8.x | Version 1.x | +--------------------------------------------+----------------------+ | ITSI 2.x / 3.x / 4.x | Version 1.x | +--------------------------------------------+----------------------+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Components deployment matrix ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ **Metricator for Nmon stack components:** +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ | Component name | Purpose | Installation | | | | | +============================================+==============================================================+================================+ | metricator-for-nmon | Front-user core application | Search Heads | +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ | SA-metricator-for-nmon | Support Add-on for index-time configurations | Indexers | +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ | TA-metricator-for-nmon | Technical Add-on for metrics and inventory generation | Each monitored server | +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ | TA-metricator-hec-for-nmon | Technical Add-on for metrics and inventory generation | Each monitored server | +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ | DA-ITSI-METRICATOR-NMON | ITSI module for Nmon Metricator | ITSI search head(s) | +--------------------------------------------+--------------------------------------------------------------+--------------------------------+ **ONLY** one technical addon must be deployed on the same host, **BUT** you can mix any both types of addons in your deployment. --------------------- Index time operations --------------------- The application operates index-time processing . The Support Add-on **SA-metricator-for-nmon** must be deployed on Splunk indexers for the application to operate normally. If there are any Heavy Forwarders, formerly known as **HF**, acting as intermediate forwarders between indexers and Universal Forwarders, the Support Addon or the Technical Addon should be deployed on these instances. ---------------- Indexes creation ---------------- **The core front-end application "metricator-for-nmon" does not create any index at installation time.** The application stack uses a model by default which requires 4 indexes to be created: +--------------------------------+-------------------------------------------------------------------------------------+ | Index name | Purpose | +================================+=====================================================================================+ | os-unix-nmon-metrics | metric store index for metrics data storage | +--------------------------------+-------------------------------------------------------------------------------------+ | os-unix-nmon-events | nmon data stored as regular events | +--------------------------------+-------------------------------------------------------------------------------------+ | os-unix-nmon-config | nmon configuration data | +--------------------------------+-------------------------------------------------------------------------------------+ | os-unix-nmon-internal | internal data generated by the application for various processing tasks | +--------------------------------+-------------------------------------------------------------------------------------+ These indexes should be created in the context of the Support Addon **SA-metricator-for-nmon** or in your own custom base configuration applications. The Support Addon does not create the indexes automatically as Splunk inspection does not allow third party applications to do it, consult the deployment pages in this documentation to get a sample indexes.conf for your deployment. It is entirely possible to easily customize the indexes names if you need it, please review the installation documentation for more information. ---------------------------- Summarization implementation ---------------------------- **Accelerated data models:** The front-user core application **metricator-for-nmon** implements 2 data models that should be accelerated over a short period of time. **Splunk certification requirements prohibit the default activation of data models acceleration and as such, Splunk admins should proceed to the activation of the datamodels acceleration.** +--------------------------------+-------------------------------------------------------------------------------------+ | Data model name | Recommended acceleration period | +================================+=====================================================================================+ | metricator-nmon-config | 1 month | +--------------------------------+-------------------------------------------------------------------------------------+ | os-unix-nmon-events | 1 month | +--------------------------------+-------------------------------------------------------------------------------------+ For best performance and expected behaviour, it is highly recommended to activate the acceleration of these 2 data models. The associated cost with these data models is very low and can be easily analysed in Splunk, specially by using the TCO dashboard within the Metricator application. **ITSI module for Nmon Metricator:** The ITSI module owns a data model that is designed to manage the inventory data to build the entities import in ITSI. By default, this data model is NOT accelerated, it is however recommendable to accelerate the data model which will drastically improve the server performance and reduce the associated workload: +--------------------------------+-------------------------------------------------------------------------------------+ | Data model name | Recommended acceleration period | +================================+=====================================================================================+ | metricator-nmon-config | 1 month | +--------------------------------+-------------------------------------------------------------------------------------+ **Accelerated reports:** The following reports use report acceleration feature: +----------------------------------------------------------------------------------------+---------------------------------------------+ | report name | Default and recommended acceleration period | +========================================================================================+=============================================+ | Number of notable events in Data Processing or Data Collect for the last 24 Hours | 1 day | +----------------------------------------------------------------------------------------+---------------------------------------------+ | Volume of data indexed in the last 7 days | 7 days | +----------------------------------------------------------------------------------------+---------------------------------------------+ Please review the :ref:`large_scale_deployment` documentation. -------------------------------------------- Open source and licensed materials reference -------------------------------------------- - Nmon for Linux: http://nmon.sourceforge.net - Sarmon for Oracle Solaris: http://www.geckotechnology.com/sarmon - css materials from http://www.w3schools.com - d3 from Michael Bostock: https://bl.ocks.org - various extensions and components from the Splunk 6.x Dashboard Examples application: https://splunkbase.splunk.com/app/1603 - dark.css from: http://www.brainfold.net/2016/04/splunk-dashboards-looks-more-beautiful.html - Take the tour component from https://github.com/ftoulouse/splunk-components-collection - hover.css from http://ianlunn.github.io/Hover - free of use icons from /www.iconfinder.com - Javascript tips (inputs highlighting) from https://splunkbase.splunk.com/app/3171 - https://blog.octoinsight.com/splunk-dashboards-highlighting-required-inputs - Accordion panels from https://splunkbase.splunk.com/app/3689