<\/p>\n
![\"\"](\"https:\/\/51.68.196.81\/octamis-blog\/wp-content\/uploads\/2017\/05\/Selection_604-300x79.png\")
<\/h2>\nPRODUCT OVERVIEW<\/span><\/h2>\n\n- Official Splunk application for performance metric collection of Unix and Linux servers<\/li>\n
- URL:\u00a0https:\/\/splunkbase.splunk.com\/app\/273\/<\/a><\/li>\n
- Splunk built<\/li>\n
- Splunk supported for customers under license<\/li>\n
- community support<\/li>\n<\/ul>\n
System compatibility:<\/b><\/p>\n\n- Any Unix base system: AIX, Solaris, Linux, Mac OS X…<\/span><\/li>\n<\/ul>\n
Splunk compatibility notes:<\/b><\/p>\n\n- Splunk 5.x \/ 6.x for the technical addon<\/span><\/li>\n
- Splunk 6.x for search heads, indexers<\/span><\/li>\n<\/ul>\n
Indexing volume (licence cost per server):<\/b><\/p>\n\n- Approx. 200 mb per day \/ per host (including log files)<\/span><\/li>\n
- Approx. 100 mb per day \/ per host (only for performance and inventory metrics)<\/span><\/li>\n<\/ul>\n
Data sources:<\/b><\/p>\n\n- Various performance monitors through multiple input scripts<\/span><\/li>\n
- Changes to files in \u201c\/var\/log\u201d and \u201c\/etc\u201d<\/span><\/li>\n<\/ul>\n
Notes: <\/b><\/p>\n
Data source can be activated \/ deactivated on a per data source basis.\u00a0<\/span>Time between measures can be increased to lower the volume of data to be generated.<\/span><\/p>\n <\/p>\n
![\"\"](\"https:\/\/51.68.196.81\/octamis-blog\/wp-content\/uploads\/2017\/05\/Selection_602-300x100.png\")
<\/p>\n
<\/h2>\nPRODUCT OVERVIEW<\/span><\/h2>\n\n- Open source and community application for Splunk, collects and analyse performance metrics<\/li>\n
- URL:\u00a0https:\/\/splunkbase.splunk.com\/app\/1753\/<\/a><\/li>\n
- community\u00a0built<\/li>\n
- not supported by Splunk<\/li>\n
- community support for free users and company support for users under support contracts with Octamis !<\/li>\n<\/ul>\n
System compatibility:<\/b><\/p>\n\n- AIX<\/span><\/li>\n
- Solaris (sparc, x86)<\/span><\/li>\n
- Linux (any distribution, any processor architecture including x86 32 and 64 bits, PowerPC, ARM…)<\/span><\/li>\n<\/ul>\n
Splunk compatibility notes:<\/b><\/p>\n\n- Splunk 6.x for the technical addon<\/span><\/li>\n
- Splunk 6.x for Splunk nodes<\/span><\/li>\n<\/ul>\n
Indexing volume (licence cost per server):<\/b><\/p>\n\n- Approx. 20 mb per day \/ per host<\/span><\/li>\n<\/ul>\n
Data sources:<\/b><\/p>\n\n- 1 unique data source produced by the nmon binary, contains a large and various number of system key monitors<\/span><\/li>\n
- Along with the performance monitors, Nmon produces and ingests on a regular basis the full server configuration<\/span><\/li>\n
- Nmon has also specific monitors per system, as for an example Nmon is able to generate performance metrics of IBM frames, Solaris zones, etc\u2026<\/span><\/li>\n<\/ul>\n
Notes: <\/b><\/p>\n
The volume and the content of the data can be centralised through a unique configuration file (nmon.conf) that allows to manage the interval between performance measures. V<\/span>arious options such as nmon binary startup arguments are available and customisation is available through the nmon.conf file. <\/span><\/p>\n <\/p>\n
FEATURES COMPARISON MATRIX<\/span><\/h2>\nData generation matrix:<\/i><\/strong><\/p>\n\n\n\nItem<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n\nPerformance metrics<\/span><\/td>\n yes<\/b><\/td>\n yes<\/b><\/td>\n<\/tr>\n\nSystem inventory data generation<\/span><\/td>\n yes<\/b><\/td>\n yes<\/b><\/td>\n<\/tr>\n\nSystem logs ingestion<\/span><\/td>\n yes<\/b><\/td>\n no<\/b><\/td>\n<\/tr>\n\nSecurity logs ingestion<\/span><\/td>\n yes<\/b><\/td>\n no<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nPerformance metrics matrix:<\/i><\/strong><\/p>\n\n\n\nItem<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n\nCPU usage metrics<\/span><\/td>\n Yes<\/b>
\n<\/span>(limited features for AIX with no support for LPAR stats, limited for PowerLinux, limited for Solaris) <\/span>
\nsourcetype=cpu<\/span><\/p>\n\n <\/p>\n<\/div>\n<\/td>\n
Yes<\/b>
\n<\/span>(with support for AIX LPAR, PowerLinux, Solaris zones)<\/span>sourcetype=nmon_data type=CPU* OR type-LPAR OR type=WLMCPU*<\/span><\/td>\n<\/tr>\n\nMemory usage metrics<\/span><\/td>\n Yes<\/b> (but limited to vmstat reporting)<\/span><\/p>\nsourcetype=vmstat<\/span><\/td>\n
Yes<\/b> (with additional advanced memory metrics per Operating Systems)<\/span>
\nsourcetype=nmon_data type=MEM* OR type=WLMMEM*<\/span><\/td>\n<\/tr>\n\nProcesses statistics<\/span><\/td>\n Yes<\/b> (these statistics have a large impact in the volume of data generated per server)<\/span>
\nsourcetype=top OR sourcetype=ps<\/span><\/td>\n Yes<\/b> (reports by default processes consuming more than 0.1% of a cpu, which is configurable)<\/span><\/p>\nsourcetype=nmon_data type=TOP OR type=UARG<\/span><\/td>\n<\/tr>\n\nFile systems performance statistics<\/span><\/td>\n Yes<\/b> (limited to iostat reporting)<\/span><\/p>\nsourcetype=iostat<\/span><\/td>\n
Yes<\/b> (extended to various disks statistics and per Operating System specific disks statistics)<\/span>
\nsourcetype=nmon_data type=DISK*<\/span><\/td>\n<\/tr>\n\nFile systems usage statistics<\/span><\/td>\n Yes<\/b><\/p>\nsourcetype=df<\/span><\/td>\n
Yes<\/b> (has limitation to % usage only , but inventory data reports on volume other statistics)<\/span>
\nsourcetype=nmon_data type=JFS*<\/span><\/td>\n<\/tr>\n\nNetwork statistics<\/span><\/td>\n Yes<\/b>
\nsourcetype=interfaces OR sourcetype=protocol<\/span><\/td>\n Yes<\/b>
\nsourcetype=nmon_data type=NET*<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nNotes: <\/span><\/i><\/p>\nThis list is not exhaustive, additional metrics are reported by both applications.<\/span><\/p>\nAs well, The Nmon application implements the “nmon external” feature which allows adding non native nmon metrics in the nmon processing.<\/p>\n
<\/p>\n
Configuration data reporting matrix:<\/i><\/strong><\/p>\n\n\n\nItem<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n\nReports main system configuration items (CPU, memory and disks configuration\u2026)<\/span><\/td>\n Yes<\/b><\/p>\n <\/p>\n
sourcetype=hardware<\/span><\/td>\n
Yes<\/b><\/p>\n <\/p>\n
sourcetype=nmon_config<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n
Splunk deployment considerations:<\/i><\/strong><\/p>\n\n\n\nItem<\/strong><\/td>\nSplunk app for *nix<\/strong><\/td>\nNMON Performance<\/strong><\/td>\n<\/tr>\n\nDistributed deployment compatibility<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nApprox volume per day \/ per server <\/span>for performance and inventory data only <\/b>(see Volume of data and licensing costs)<\/span><\/td>\n Approx. 100 MB \/ day<\/span><\/td>\n Approx 20 MB \/ day<\/span><\/td>\n<\/tr>\n\nLarge deployment at scale<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nCommon Information Model compliance<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nAdvanced built in features :<\/strong><\/span><\/i><\/p>\n\n\n\nItem<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n\nProvides coherent user interfaces for system analysis and Capacity planning management<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nProvides user interfaces to Machine Learning and other advanced analysis<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nProvides user interfaces for complex comparison<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n
Operating systems considerations:<\/i><\/strong><\/p>\n\n\n\nItem<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n\nIBM AIX<\/span><\/td>\n Yes<\/b> but very limited (no management of IBM specific metrics such as LPAR statistics)<\/span><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nORACLE SOLARIS (x86 \/ sparc)<\/span><\/td>\n Yes<\/b> but very limited (no management of Solaris specific metrics such as virtual zones statistics)<\/span><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nLINUX (all processors)<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n\nRelies on dependencies<\/span><\/td>\n Yes<\/b> (requires the package sysstat)<\/span><\/td>\n Yes<\/b>
\nLinux<\/b>: binaries for most distribution and architecture are embedded.<\/span>If no suitable binaries can be found, the addon will try to use the one available in PATH.<\/span>This feature can be controlled by configuration, and give the priority to locally available nmon binaries.<\/span>
\nSolaris<\/b>: binaries are embedded for x86 and sparc<\/span>
\nAIX<\/b>: nmon is now included by default as an official IBM package (topas-nmon), the addon will use the binary available in path<\/span>
\nInterpreter<\/b>: <\/span>For various processing tasks, the addon relies by default on Python 2.7.x.<\/span>
\nIf not available, it will fallback to Perl interpreter.<\/span>If such, it requires the Perl module \u201cTime\/HiRes\u201d.<\/span>(no specific Perl version required, untested with version prior to Perl v5)<\/span><\/td>\n<\/tr>\n\nPrivilege \/ permissions restrictions: can run as unprivileged user ?<\/span><\/td>\n Yes<\/b>, but privilege restrictions generate metrics to be unavailable on some systems<\/span><\/td>\n Yes<\/b>, with no restrictions.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n
PERFORMANCE METRICS COMPARISON<\/span><\/h2>\nSplunk app for *nix exposes the following main performance monitors:<\/strong><\/p>\n\n\n\nsourcetype<\/b><\/a><\/td>\n<\/tr>\n\nUnix:Uptime<\/span><\/td>\n<\/tr>\n\n
- \n
- Official Splunk application for performance metric collection of Unix and Linux servers<\/li>\n
- URL:\u00a0https:\/\/splunkbase.splunk.com\/app\/273\/<\/a><\/li>\n
- Splunk built<\/li>\n
- Splunk supported for customers under license<\/li>\n
- community support<\/li>\n<\/ul>\n
System compatibility:<\/b><\/p>\n
- \n
- Any Unix base system: AIX, Solaris, Linux, Mac OS X…<\/span><\/li>\n<\/ul>\n
Splunk compatibility notes:<\/b><\/p>\n
- \n
- Splunk 5.x \/ 6.x for the technical addon<\/span><\/li>\n
- Splunk 6.x for search heads, indexers<\/span><\/li>\n<\/ul>\n
Indexing volume (licence cost per server):<\/b><\/p>\n
- \n
- Approx. 200 mb per day \/ per host (including log files)<\/span><\/li>\n
- Approx. 100 mb per day \/ per host (only for performance and inventory metrics)<\/span><\/li>\n<\/ul>\n
Data sources:<\/b><\/p>\n
- \n
- Various performance monitors through multiple input scripts<\/span><\/li>\n
- Changes to files in \u201c\/var\/log\u201d and \u201c\/etc\u201d<\/span><\/li>\n<\/ul>\n
Notes: <\/b><\/p>\n
Data source can be activated \/ deactivated on a per data source basis.\u00a0<\/span>Time between measures can be increased to lower the volume of data to be generated.<\/span><\/p>\n
<\/p>\n
<\/p>\n<\/h2>\n
PRODUCT OVERVIEW<\/span><\/h2>\n
- \n
- Open source and community application for Splunk, collects and analyse performance metrics<\/li>\n
- URL:\u00a0https:\/\/splunkbase.splunk.com\/app\/1753\/<\/a><\/li>\n
- community\u00a0built<\/li>\n
- not supported by Splunk<\/li>\n
- community support for free users and company support for users under support contracts with Octamis !<\/li>\n<\/ul>\n
System compatibility:<\/b><\/p>\n
- \n
- AIX<\/span><\/li>\n
- Solaris (sparc, x86)<\/span><\/li>\n
- Linux (any distribution, any processor architecture including x86 32 and 64 bits, PowerPC, ARM…)<\/span><\/li>\n<\/ul>\n
Splunk compatibility notes:<\/b><\/p>\n
- \n
- Splunk 6.x for the technical addon<\/span><\/li>\n
- Splunk 6.x for Splunk nodes<\/span><\/li>\n<\/ul>\n
Indexing volume (licence cost per server):<\/b><\/p>\n
- \n
- Approx. 20 mb per day \/ per host<\/span><\/li>\n<\/ul>\n
Data sources:<\/b><\/p>\n
- \n
- 1 unique data source produced by the nmon binary, contains a large and various number of system key monitors<\/span><\/li>\n
- Along with the performance monitors, Nmon produces and ingests on a regular basis the full server configuration<\/span><\/li>\n
- Nmon has also specific monitors per system, as for an example Nmon is able to generate performance metrics of IBM frames, Solaris zones, etc\u2026<\/span><\/li>\n<\/ul>\n
Notes: <\/b><\/p>\n
The volume and the content of the data can be centralised through a unique configuration file (nmon.conf) that allows to manage the interval between performance measures. V<\/span>arious options such as nmon binary startup arguments are available and customisation is available through the nmon.conf file. <\/span><\/p>\n
<\/p>\n
FEATURES COMPARISON MATRIX<\/span><\/h2>\n
Data generation matrix:<\/i><\/strong><\/p>\n
\n\n
\n Item<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n \n Performance metrics<\/span><\/td>\n yes<\/b><\/td>\n yes<\/b><\/td>\n<\/tr>\n \n System inventory data generation<\/span><\/td>\n yes<\/b><\/td>\n yes<\/b><\/td>\n<\/tr>\n \n System logs ingestion<\/span><\/td>\n yes<\/b><\/td>\n no<\/b><\/td>\n<\/tr>\n \n Security logs ingestion<\/span><\/td>\n yes<\/b><\/td>\n no<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Performance metrics matrix:<\/i><\/strong><\/p>\n
\n\n
\n Item<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n \n CPU usage metrics<\/span><\/td>\n Yes<\/b>
\n<\/span>(limited features for AIX with no support for LPAR stats, limited for PowerLinux, limited for Solaris) <\/span>
\nsourcetype=cpu<\/span><\/p>\n\n<\/p>\n<\/div>\n<\/td>\n
Yes<\/b>
\n<\/span>(with support for AIX LPAR, PowerLinux, Solaris zones)<\/span>sourcetype=nmon_data type=CPU* OR type-LPAR OR type=WLMCPU*<\/span><\/td>\n<\/tr>\n\n Memory usage metrics<\/span><\/td>\n Yes<\/b> (but limited to vmstat reporting)<\/span><\/p>\n sourcetype=vmstat<\/span><\/td>\n
Yes<\/b> (with additional advanced memory metrics per Operating Systems)<\/span>
\nsourcetype=nmon_data type=MEM* OR type=WLMMEM*<\/span><\/td>\n<\/tr>\n\n Processes statistics<\/span><\/td>\n Yes<\/b> (these statistics have a large impact in the volume of data generated per server)<\/span>
\nsourcetype=top OR sourcetype=ps<\/span><\/td>\nYes<\/b> (reports by default processes consuming more than 0.1% of a cpu, which is configurable)<\/span><\/p>\n sourcetype=nmon_data type=TOP OR type=UARG<\/span><\/td>\n<\/tr>\n
\n File systems performance statistics<\/span><\/td>\n Yes<\/b> (limited to iostat reporting)<\/span><\/p>\n sourcetype=iostat<\/span><\/td>\n
Yes<\/b> (extended to various disks statistics and per Operating System specific disks statistics)<\/span>
\nsourcetype=nmon_data type=DISK*<\/span><\/td>\n<\/tr>\n\n File systems usage statistics<\/span><\/td>\n Yes<\/b><\/p>\n sourcetype=df<\/span><\/td>\n
Yes<\/b> (has limitation to % usage only , but inventory data reports on volume other statistics)<\/span>
\nsourcetype=nmon_data type=JFS*<\/span><\/td>\n<\/tr>\n\n Network statistics<\/span><\/td>\n Yes<\/b>
\nsourcetype=interfaces OR sourcetype=protocol<\/span><\/td>\nYes<\/b>
\nsourcetype=nmon_data type=NET*<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nNotes: <\/span><\/i><\/p>\n
This list is not exhaustive, additional metrics are reported by both applications.<\/span><\/p>\n
As well, The Nmon application implements the “nmon external” feature which allows adding non native nmon metrics in the nmon processing.<\/p>\n
<\/p>\n
Configuration data reporting matrix:<\/i><\/strong><\/p>\n
\n\n
\n Item<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n \n Reports main system configuration items (CPU, memory and disks configuration\u2026)<\/span><\/td>\n Yes<\/b><\/p>\n <\/p>\n
sourcetype=hardware<\/span><\/td>\n
Yes<\/b><\/p>\n <\/p>\n
sourcetype=nmon_config<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/p>\n
Splunk deployment considerations:<\/i><\/strong><\/p>\n
\n\n
\n Item<\/strong><\/td>\n Splunk app for *nix<\/strong><\/td>\n NMON Performance<\/strong><\/td>\n<\/tr>\n \n Distributed deployment compatibility<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n Approx volume per day \/ per server <\/span>for performance and inventory data only <\/b>(see Volume of data and licensing costs)<\/span><\/td>\n Approx. 100 MB \/ day<\/span><\/td>\n Approx 20 MB \/ day<\/span><\/td>\n<\/tr>\n \n Large deployment at scale<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n Common Information Model compliance<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nAdvanced built in features :<\/strong><\/span><\/i><\/p>\n\n\n
\n Item<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n \n Provides coherent user interfaces for system analysis and Capacity planning management<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n Provides user interfaces to Machine Learning and other advanced analysis<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n Provides user interfaces for complex comparison<\/span><\/td>\n No<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n
Operating systems considerations:<\/i><\/strong><\/p>\n
\n\n
\n Item<\/b><\/td>\n Splunk app for *nix<\/b><\/td>\n NMON Performance<\/b><\/td>\n<\/tr>\n \n IBM AIX<\/span><\/td>\n Yes<\/b> but very limited (no management of IBM specific metrics such as LPAR statistics)<\/span><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n ORACLE SOLARIS (x86 \/ sparc)<\/span><\/td>\n Yes<\/b> but very limited (no management of Solaris specific metrics such as virtual zones statistics)<\/span><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n LINUX (all processors)<\/span><\/td>\n Yes<\/b><\/td>\n Yes<\/b><\/td>\n<\/tr>\n \n Relies on dependencies<\/span><\/td>\n Yes<\/b> (requires the package sysstat)<\/span><\/td>\n Yes<\/b>
\nLinux<\/b>: binaries for most distribution and architecture are embedded.<\/span>If no suitable binaries can be found, the addon will try to use the one available in PATH.<\/span>This feature can be controlled by configuration, and give the priority to locally available nmon binaries.<\/span>
\nSolaris<\/b>: binaries are embedded for x86 and sparc<\/span>
\nAIX<\/b>: nmon is now included by default as an official IBM package (topas-nmon), the addon will use the binary available in path<\/span>
\nInterpreter<\/b>: <\/span>For various processing tasks, the addon relies by default on Python 2.7.x.<\/span>
\nIf not available, it will fallback to Perl interpreter.<\/span>If such, it requires the Perl module \u201cTime\/HiRes\u201d.<\/span>(no specific Perl version required, untested with version prior to Perl v5)<\/span><\/td>\n<\/tr>\n\n Privilege \/ permissions restrictions: can run as unprivileged user ?<\/span><\/td>\n Yes<\/b>, but privilege restrictions generate metrics to be unavailable on some systems<\/span><\/td>\n Yes<\/b>, with no restrictions.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/p>\n
PERFORMANCE METRICS COMPARISON<\/span><\/h2>\n
Splunk app for *nix exposes the following main performance monitors:<\/strong><\/p>\n
\n\n
\n sourcetype<\/b><\/a><\/td>\n<\/tr>\n \n Unix:Uptime<\/span><\/td>\n<\/tr>\n \n - Along with the performance monitors, Nmon produces and ingests on a regular basis the full server configuration<\/span><\/li>\n
- 1 unique data source produced by the nmon binary, contains a large and various number of system key monitors<\/span><\/li>\n
- Splunk 6.x for Splunk nodes<\/span><\/li>\n<\/ul>\n
- Solaris (sparc, x86)<\/span><\/li>\n
- Changes to files in \u201c\/var\/log\u201d and \u201c\/etc\u201d<\/span><\/li>\n<\/ul>\n
- Approx. 100 mb per day \/ per host (only for performance and inventory metrics)<\/span><\/li>\n<\/ul>\n
- Splunk 6.x for search heads, indexers<\/span><\/li>\n<\/ul>\n
- Splunk 5.x \/ 6.x for the technical addon<\/span><\/li>\n