#splunk-pcf-monitor

A splunk app for monitoring and alerting of Pivotal Cloud Foundry using Pivotal OpsMetrics.

Splunk-pcf-monitor is based off of the work done by damiendallimore

Setup

These directions assume you already have an installed splunk server to work from. If you do not, you can get splunk and its installation instructions from: Splunk

This product has been tested with Splunk 6.0 and 6.1. If you are using older versions some modification may be required.

Procedure

• The app upload feature of the splunk GUI requires a tar.gz file. To download this project in that format use the following link: https://github.com/mjseid/splunk-pcf-monitor/archive/master.tar.gz
• Login to splunk the splunk UI. Select "manage apps" and choose to install app from file. Point to the previously downloaded .tar.gz file
• Once the app is installed, log in to your splunk server and edit the config files to point to your OpsMetrics installation
• edit /opt/splunk/etc/apps/jmx_cf/bin/config/example_config.xml to your opsmetric and save as new file

cp /opt/splunk/etc/apps/jmx_cf/bin/config/example_config.xml /opt/splunk/etc/apps/jmx_cf/bin/config/prod_pcf_config.xml
vi /opt/splunk/etc/apps/jmx_cf/bin/config/prod_pcf_config.xml

The only line you have to change will look like this:

<jmxserver host="<IP_OF_YOUR_OPSMETRICS_VM>" jvmDescription="<DESCRIPTION_OF_YOUR_PCF_ENVIONRMENT>" jmxport="44444" jmxuser="<User you selected for PCF OPSMETRICS>" jmxpass="<PASSWORD_YOU_SELECTED_FOR_OPSMETRICS>">

• In the splunk UI, go to settings -> data inputs -> JMX -> add new JMX input. Here is an example of a new input for monitoring aproduction PCF deployment:

JMX Input Name	Prod PCF
Config File Name	prod_pcf_config.xml
Set SourceType	manual
Polling Frequency	60
Source Type	jmx
More Settings -> index	jmx_cf

• Repeat the following two steps for any additional PCF enviornments you would like to monitor.

Alerting

This app comes with some pre-defined alerts out of the box. To recieve emails based on these alerts, you must do the following:

• Ensure that splunk is configured to send email alerts. This includes setting the correct mail host and any required credentials in the splunk system settings.
• You can perform a bulk update of the email address for predefined alerts by logging on to the splunk server and editing the following file:

sed -ie 's/[email protected]/[email protected]/g' /opt/splunk/etc/apps/jmx_cf/local/savedsearches.conf

where [email protected] is the email (or comma seperated list of emails) you wish to send alerts to