My Job, Syslog, and Splunk
Posted by in SysadminI have been working as the Senior Systems Engineer in the operations group at a company called Airbiquity for the past year or so.
As part of my daily job I come into contact with many new and interesting products and things that help me do my job better.
Firstly, how often do you find that you need to constantly debug several machines at one? Tailing syslogs on each box can become a nightmare when you have more than one machine to look at. Consider these options…
- Configure your systems with syslog-ng to forward to a centralized syslog server where you can “tail -f” your problems easily.
- Buy expensive products such as SolarWinds syslog and snmp trap collector.
- Use a free (500mb/day) syslog collector and search utility called Splunk
After messing with the SolarWinds products for a while I decided to move against it towards open source and free/cheaper options.
At Airbiquity I configured all of our servers and network equipment to send their syslog requests to a centralized syslog server. This was great for work debugging but I had trouble letting my boss have an easy utility that they could search with.
This is when I setup Splunk, it’s easy to install and while it can be load intensive it was a lot more intuitive and easy to use than the SolarWinds offering. So far it’s been great and we’re going to start looking into AD integration and clustering to support our multiple data centers.
Installing Splunk is as easy as pie, just download the RPM, they even provide a wget url.
Once you’ve downloaded just install using your flavor’s package system. They even provide a source version which you can install on any Linux distro, as well as an executable Windows version.
Redhat, SLES, etc.
rpm -ivh <yoursplunkdownload>.rpm
Ubuntu, Debian etc.
dpkg -i <yoursplunkdownload>.deb
Everything Else
tar -xzvf <yoursplunkdownload>.tgz; cd <newsplunkfolder>;./install.sh
Once you’ve installed splunk you can enable auto start like so…
/opt/splunk/bin/splunk enable boot-start
Pretty easy and you just run your new splunk init script to start it, you’ll then be able to connect to it using your servers url on port 8000.
http://<yoursitesip>:8000
You can follow any responses to this entry through the RSS 2.0 You can leave a response, or trackback.
