guilhemmarchand/nmon-for-splunk

nmon in Docker?

Closed this issue · 7 comments

Hello,
Did you try to run Splunk with TA-nmon in Docker?
Its enough to run container with --net host --pid host --privileged to monitor hosts metrics ? The nmon binary is compiled by you?

It is possible to mount root of host to container like -v /:/hostfs/, but dont know if nmon even using this path and if its even prefixable.

For example, Telegraf using this https://github.com/influxdata/telegraf/blob/master/plugins/inputs/system/DISK_README.md

Thanks

Hello !

That's a pretty good question.

Actually, I use to run the TA-nmon for testing purposes within Ubuntu LXD containers, in LXD all metrics but the sub disk system work as expected.

I am lacking knowledge of Docker to be honest, however I did a test using the following Splunk docker implementation:

https://github.com/mhassan2/splunk-n-box

In this context, I can see that Nmon reports properly all the metric we expect, including disks metrics.

I will be very interested in your feedback on this topic.
We could as well use the nmon external to add non nmon native metrics, in other words, running a command by the nmon scheduler and get the metrics imported into nmon data. (http://ta-nmon-hec.readthedocs.io/en/latest/external.html)

To reply to your question regarding the binary compilation, many of the binaries come from the official Nmon Linux site:

http://nmon.sourceforge.net/pmwiki.php?n=Site.Download

When the binaries are lacking, yes I'm compiling the binaries myself. (See: https://github.com/guilhemmarchand/nmon-binaries)

Guilhem

Seem that File System is not supported. But everything else seems to be OK.

You can not directly mount hostfs to container like -v /:/ , you need to mount it like -v /:/hostfs/ for example.
But nmon in default looks to / path for file system stats. Then you need force nmon to look for file system stats elsewhere for example to /hostfs/ path.

EDIT:
Is possible to rewrite code.
All paths in nmon sourcecode should be prefixed with: ${hostfs_prefix}etc/...
${hostfs_prefix} = environment variable,
if not set = /
if set = /hostfs/

I dont think that author should do this.
But you can if you can C :)

Hi,

That's pretty interesting ;-)

Actually, nmon for Linux is an Open source software, so we are free to access and modify the source code and run a specific binary for that case.
This could also be embedded within the source code, if that can be run nicely on all systems.

What do you mean by "I dont think that author should do this." ?

Nmon already uses variable env for different configuration or features (such as the external collection), what about opening a feature request to the author of Nmon ?

https://sourceforge.net/p/nmon/feature-requests/

Hello,
You can try it, seems that mount are resolved too.
You have to setup forwarding and ta-nmon offcourse.

 docker rm -f splunk_heavyforwarder_custom; docker run \
-d \
--name splunk_heavyforwarder_custom \
--env SPLUNK_USER=root \
-v /opt/splunk_heavyforwarder_custom/etc:/opt/splunk/etc \
-v /opt/splunk_heavyforwarder_custom/var:/opt/splunk/var \
-v /:/rootfs:ro  \
-v /etc/os-release:/etc/os-release:ro  \
-v /etc/lsb-release:/etc/lsb-release:ro    \
--pid=host \
--privileged     \
--net=host  \
-e TZ=Europe/Prague \
-e "SPLUNK_START_ARGS=--accept-license --answer-yes --no-prompt " \
splunk/splunk:latest

Hi,

Thanks, I will test that ASAP !

Regards,

Guilhem

@guilhemmarchand Hi! Did you test it? Thanks

@muhahacz

Hello !

Yes I did a quick test on a docker instance and it looked to work properly.
I have in the back log to run much more bigger tests on docker instances running in Kubernetes / Openshift clusters.

What's the context of your docker implementation ?