Standalone Installation of Nmon Performance Monitor
The Nmon App can be installed in a single and standalone Splunk instance, most probably for testing purposes.
VIDEO TUTORIAL:
Checkout this video demo: https://www.youtube.com/watch?v=-0H-CJDIGDI
Since the major release V1.7, the core application does not create anymore the "nmon" index automatically (Splunk app certification criteria)
As such, please ensure you create the "nmon" index before deploying the TA-nmon to the standalone Splunk instance or clients instances:
In such a case, on the Nmon Core App (the standard package downloadable in Splunk Apps) has to be installed.
A standalone installation will or can operate as:
- Indexer
- Search Head
- Deployment Server
Please follow these instructions:
1. Install the Nmon Core Application
You can install the Application directly within Splunk Application management:
Application Menu > Manage Apps
Then search for "nmon":
You can also download the App from Splunk base and install it manually within Splunk:
Download the App here:
https://splunkbase.splunk.com/app/1753/
Then you can use the Splunk App Manage to select the file you downloaded, or simply uncompress the tar.gz archive in $SPLUNK_HOME/etc/apps (example: /opt/splunk/etc/apps) and restart Splunk
2. Install the TA-nmon technical addon application
Since the major release V1.7, the core application does bring data generation related objects, you must install the TA-nmon
If you want so, and if you are running Splunk on one of OS listed above, you just need to install the TA-nmon addon:
The TA-nmon were supplied as an entire add-on on Splunk base with the publication of the release 1.7.0, the TA-nmon package is still available but its extension is now tgz instead of tar.gz
Release V1.6.15 or previous:
cd /opt/splunk/etc/apps
tar -xvzf /opt/splunk/etc/apps/nmon/resources/TA-nmon/TA-nmon_*.tar.gz
Release V1.7.x and later:
cd /opt/splunk/etc/apps
tar -xvzf /opt/splunk/etc/apps/nmon/resources/TA-nmon/TA-nmon_*.tgz
Restart Splunk
3. Windows Specific Instructions
If relevant for you and if you are using Windows, you must install a valid Python 2.x interpreter, this can be very easily achieved:
Download and Install Python 2.x package for Windows from: https://www.python.org/download
inputs.conf and props.conf:
- Copy the inputs.conf_forWindows file from default to local/inputs.conf (in the TA-nmon directory)
- Copy the props.conf_forWindows file from default to local/props.conf (in the TA-nmon directory)
Restart Splunk.
4. On AIX / Solaris / Linux host: Activate local Performance data generation
This comes automatically with the installation of the TA-nmon.
5. Common scenarios of use in standalone installation
There are some scenarios you may be interested in while running Nmon Splunk App in a standalone Splunk installation:
5.1. Testing the Application with Eventgen
Please see this page to test the Application using Eventgen and samples of data provided by the App.
5.2. Managing cold Nmon data generated out of Splunk
A another common scenario of use (for testing or not) will be to manage repositories of Nmon raw data files that have been generated out of Splunk.
The Application can manage as mush as custom input monitors to automatically manage your collection of Nmon raw data files:
It is important to create a custom input in a "local/inputs.conf" such that it does not get overwritten when the Application gets updated.
**The only requirement is to create a custom input to watch for Nmon files, here are some examples of monitor configuration: **
[monitor:///mnt/NFS-SHARE/nmon-repository/*/*nmon]
disabled = false
index = nmon
sourcetype = nmon_processing
crcSalt = <SOURCE>
Or an alternative version using whitelist and manage any nmon files in sub folders:
[monitor:///mnt/NFS-SHARE/nmon-repository/]
disabled = false
whitelist = \.nmon$
index = nmon
sourcetype = nmon_processing
crcSalt = <SOURCE>
And even:
[monitor:///mnt/NFS-SHARE/nmon-repository/.../*.nmon]
disabled = false
index = nmon
sourcetype = nmon_processing
crcSalt = <SOURCE>
And even:
[monitor:///mnt/NFS-SHARE/nmon-repository/.../*.nmon]
disabled = false
index = nmon
sourcetype = nmon_processing
crcSalt = <SOURCE>
After adding the input, please restart Splunk.
Immediately after restart, the App should start managing available Nmon files, look in the nmon_processing sourcetype to get the current activity of the Nmon processing steps:
index=nmon sourcetype=nmon_processing
Or open the report: "Activity of NMON Data Processing"
5.3. Deployment Server
Even in a standalone installation, you may be interested in Deploying the TA-nmon to some clients, specially for testing purposes. (with virtual machines for example)
Please follow this page to learn how to deploy the TA-nmon package.