About the Metricator for Nmon application

  • Author: Octamis limited U.K - Guilhem Marchand

  • Purposes:

The Metricator for Nmon application for Splunk implements the excellent and powerful nmon binary known as Nigel’s performance monitor.

Originally developed for IBM AIX performance monitoring and analysis, it is now an Open source project available to many other systems. It is fully available for any Linux flavor, and thanks to the excellent work of Guy Deffaux, it also available for Solaris 10/11 systems using the sarmon project.

The Metricator for Nmon application stack for Splunk generates performance and inventory data for your servers, and provides a rich number of monitors and tools to manage your AIX / Linux / Solaris servers.

Splunk compatibility

Technical addons compatibility

There are currently 2 versions of the technical addon which have different compatibility requirements:

TA-metricator-for-nmon

The TA-metricator-for-nmon addon uses regular file monitoring for forward events and metrics to the Splunk infrastructure, it is compatible with:

Metricator for Nmon stack

Major version branch

Splunk Universal Forwarder 7.x, 8.x

Version 1.1.x

TA-metricator-hec-for-nmon

The TA-metricator-hec-for-nmon addon uses the Splunk HTTP Event Collector (HEC) to forward metrics and nmon data events, it is compatible with:

Metricator for Nmon stack

Major version branch

Splunk Universal Forwarder 6.x, 7.x, 8.x

Version 1.1.x

Front-end and indexing components compatibility

The Metricator for Nmon front-end application “metricator-for-nmon” and the Support Addon for indexing “SA-metricator-for-nmon” are compatibles with:

Metricator for Nmon stack

Major version branch

Splunk 7.x, Splunk 8.x

Version 1.1.x

ITSI module for Nmon Metricator

The ITSI module for Nmon Metricator provides builting KPIs, entity import, service template and host health views:

Metricator for Nmon stack

Major version branch

Splunk 7.x, Splunk 8.x

Version 1.x

ITSI 2.x / 3.x / 4.x

Version 1.x

Components deployment matrix

Metricator for Nmon stack components:

Component name

Purpose

Installation

metricator-for-nmon

Front-user core application

Search Heads

SA-metricator-for-nmon

Support Add-on for index-time configurations

Indexers

TA-metricator-for-nmon

Technical Add-on for metrics and inventory generation

Each monitored server

TA-metricator-hec-for-nmon

Technical Add-on for metrics and inventory generation

Each monitored server

DA-ITSI-METRICATOR-NMON

ITSI module for Nmon Metricator

ITSI search head(s)

ONLY one technical addon must be deployed on the same host, BUT you can mix any both types of addons in your deployment.

Index time operations

The application operates index-time processing .

The Support Add-on SA-metricator-for-nmon must be deployed on Splunk indexers for the application to operate normally.

If there are any Heavy Forwarders, formerly known as HF, acting as intermediate forwarders between indexers and Universal Forwarders, the Support Addon or the Technical Addon should be deployed on these instances.

Indexes creation

The core front-end application “metricator-for-nmon” does not create any index at installation time.

The application stack uses a model by default which requires 4 indexes to be created:

Index name

Purpose

os-unix-nmon-metrics

metric store index for metrics data storage

os-unix-nmon-events

nmon data stored as regular events

os-unix-nmon-config

nmon configuration data

os-unix-nmon-internal

internal data generated by the application for various processing tasks

These indexes should be created in the context of the Support Addon SA-metricator-for-nmon or in your own custom base configuration applications.

The Support Addon does not create the indexes automatically as Splunk inspection does not allow third party applications to do it, consult the deployment pages in this documentation to get a sample indexes.conf for your deployment.

It is entirely possible to easily customize the indexes names if you need it, please review the installation documentation for more information.

Summarization implementation

Accelerated data models:

The front-user core application metricator-for-nmon implements 2 data models that should be accelerated over a short period of time.

Splunk certification requirements prohibit the default activation of data models acceleration and as such, Splunk admins should proceed to the activation of the datamodels acceleration.

Data model name

Recommended acceleration period

metricator-nmon-config

1 month

os-unix-nmon-events

1 month

For best performance and expected behaviour, it is highly recommended to activate the acceleration of these 2 data models.

The associated cost with these data models is very low and can be easily analysed in Splunk, specially by using the TCO dashboard within the Metricator application.

ITSI module for Nmon Metricator:

The ITSI module owns a data model that is designed to manage the inventory data to build the entities import in ITSI. By default, this data model is NOT accelerated, it is however recommendable to accelerate the data model which will drastically improve the server performance and reduce the associated workload:

Data model name

Recommended acceleration period

metricator-nmon-config

1 month

Accelerated reports:

The following reports use report acceleration feature:

report name

Default and recommended acceleration period

Number of notable events in Data Processing or Data Collect for the last 24 Hours

1 day

Volume of data indexed in the last 7 days

7 days

Please review the Large scale deployment considerations documentation.

Open source and licensed materials reference