Splunk Universal Forwarder for AIX

--- tags: Splunk, Puppet --- # Splunk Universal Forwarder for AIX Wir möchten die Anforderungen für den USF (Universal Splunk Forwarder) on AIX Zusammentragen. Folgen soll dann die Implementation via Puppet. :::info Datum: 2021-10-25 / 10:00h Teilnehmer: - Nicole Schröder (Daniels) - Stephan De Veen (Reeves) - Patrick Schramm (Osborn) - Rüdiger Mueck ::: --- - Installation auf Anforderung - Meist auf IHS/WAS/TIM/TAM und DB2 - ca. 200 Systeme mit abweichenden Installationen - VG Names - LV Names and Sizes - FS Mountpoints :::spoiler Splunk Systeme ~~~ acs14z: /dev/splunklv:5120.00:/opt/splunk acs16a: /dev/splunklv:1024.00:/opt/splunk acs16b: /dev/splunklv:1024.00:/opt/splunk acs18l: /dev/splunklv:2048.00:/opt/splunk acs18m: /dev/splunklv:2048.00:/opt/splunk acs19a: /dev/optsplunklv:2048.00:/opt/splunk acs19b: /dev/optsplunklv:2048.00:/opt/splunk acs19c: /dev/optsplunklv:2048.00:/opt/splunk acs19d: /dev/optsplunklv:2048.00:/opt/splunk acs19e: /dev/optsplunklv:2048.00:/opt/splunk acs19f: /dev/optsplunklv:2048.00:/opt/splunk acs301: /dev/splunklv:10112.00:/opt/splunk acs302: /dev/splunklv:1024.00:/opt/splunk acs303: /dev/optsplunklv:2048.00:/opt/splunk acs304: /dev/optsplunklv:2048.00:/opt/splunk acs305: /dev/optsplunklv:2048.00:/opt/splunk acs32a: /dev/splunklv:1024.00:/opt/splunk acs32b: /dev/splunklv:1024.00:/opt/splunk acs32p: /dev/SPLUNK:1024.00:/opt/splunk acs32r: /dev/hd10opt:3328.00:/opt acs34a: /dev/optsplunklv:2048.00:/opt/splunk acs34b: /dev/optsplunklv:2048.00:/opt/splunk acs36f: /dev/hd10opt:3328.00:/opt acs36g: /dev/hd10opt:3328.00:/opt acs36h: /dev/hd10opt:3328.00:/opt acs37b: /dev/splunklv:1024.00:/opt/splunk acs392: /dev/hd10opt:3328.00:/opt acs393: /dev/hd10opt:3328.00:/opt acs394: /dev/hd10opt:3328.00:/opt acs395: /dev/hd10opt:3328.00:/opt acs66: /dev/splunklv:9216.00:/opt/splunk acs67: /dev/splunklv:9216.00:/opt/splunk acs68: /dev/splunklv:11136.00:/opt/splunk acs69: /dev/splunklv:11136.00:/opt/splunk acs6g: /dev/splunklv:10112.00:/opt/splunk acs6h: /dev/splunklv:10112.00:/opt/splunk acs6i: /dev/splunklv:10112.00:/opt/splunk acs6j: /dev/splunklv:10112.00:/opt/splunk acs37a: /dev/splunklv:1024.00:/opt/splunk acs6k: /dev/splunklv:10112.00:/opt/splunk acs6l: /dev/splunklv:10112.00:/opt/splunk acs6m: /dev/splunklv:10112.00:/opt/splunk acs6n: /dev/splunklv:10112.00:/opt/splunk acs6o: /dev/splunklv:10112.00:/opt/splunk acs6p: /dev/splunklv:10112.00:/opt/splunk acs6q: /dev/splunklv:10112.00:/opt/splunk acs6r: /dev/splunklv:10112.00:/opt/splunk acs6s: /dev/splunklv:10112.00:/opt/splunk acs6t: /dev/splunklv:10112.00:/opt/splunk acs6u: /dev/splunklv:10112.00:/opt/splunk acs6v: /dev/splunklv:10112.00:/opt/splunk acs6w: /dev/splunklv:10112.00:/opt/splunk acs6x: /dev/splunklv:10112.00:/opt/splunk acs71: /dev/optsplunklv:2048.00:/opt/splunk acs72: /dev/optsplunklv:2048.00:/opt/splunk acs73: /dev/optsplunklv:2048.00:/opt/splunk acs74: /dev/optsplunklv:2048.00:/opt/splunk acs7b: /dev/splunk_lv:4096.00:/opt/splunk acs80: /dev/optsplunklv:2048.00:/opt/splunk ada0001q: /dev/SPLUNK:8192.00:/opt/splunk ada0001t: /dev/SPLUNK:8192.00:/opt/splunk ada0001v: /dev/SPLUNK:8192.00:/opt/splunk ada0002q: /dev/SPLUNK:8192.00:/opt/splunk ada0002t: /dev/SPLUNK:8192.00:/opt/splunk ada0002v: /dev/SPLUNK:8192.00:/opt/splunk ada0003p: /dev/SPLUNK:8192.00:/opt/splunk ada0003t: /dev/SPLUNK:8192.00:/opt/splunk ada0004p: /dev/SPLUNK:8192.00:/opt/splunk ada0004q: /dev/SPLUNK:8192.00:/opt/splunk acs7a: /dev/splunk_lv:4096.00:/opt/splunk acs81: /dev/optsplunklv:2048.00:/opt/splunk ada0005q: /dev/SPLUNK:8192.00:/opt/splunk ada0005v: /dev/SPLUNK:8192.00:/opt/splunk ada0006q: /dev/SPLUNK:8192.00:/opt/splunk ada0006t: /dev/SPLUNK:8192.00:/opt/splunk ada0006v: /dev/SPLUNK:8192.00:/opt/splunk ada0007t: /dev/SPLUNK:8192.00:/opt/splunk ada0007v: /dev/SPLUNK:8192.00:/opt/splunk ada0008t: /dev/SPLUNK:8192.00:/opt/splunk ada0008v: /dev/SPLUNK:8192.00:/opt/splunk ada0009v: /dev/SPLUNK:8192.00:/opt/splunk ada0010q: /dev/SPLUNK:8192.00:/opt/splunk ada0010v: /dev/SPLUNK:8192.00:/opt/splunk ada0016q: /dev/SPLUNK:8192.00:/opt/splunk ada0017p: /dev/SPLUNK:8192.00:/opt/splunk ada0018p: /dev/SPLUNK:8192.00:/opt/splunk ada0174p: /dev/SPLUNK:8192.00:/opt/splunk ada0018v: /dev/SPLUNK:8192.00:/opt/splunk ada0074v: /dev/SPLUNK:8192.00:/opt/splunk ada0076v: /dev/SPLUNK:8192.00:/opt/splunk ada0078v: /dev/SPLUNK:8192.00:/opt/splunk ada0084q: /dev/SPLUNK:8192.00:/opt/splunk ada0173p: /dev/SPLUNK:8192.00:/opt/splunk ada0075v: /dev/SPLUNK:8192.00:/opt/splunk ada0077v: /dev/SPLUNK:8192.00:/opt/splunk ada0083q: /dev/SPLUNK:8192.00:/opt/splunk ada0073v: /dev/SPLUNK:8192.00:/opt/splunk ada0017v: /dev/SPLUNK:8192.00:/opt/splunk ada0015q: /dev/SPLUNK:8192.00:/opt/splunk ada1001p: /dev/splunklv:10112.00:/opt/splunk ada1002p: /dev/splunklv:10112.00:/opt/splunk ada1002q: /dev/splunklv:10112.00:/opt/splunk ada1012p: /dev/splunklv:8192.00:/opt/splunk ada1001q: /dev/splunklv:10112.00:/opt/splunk ada1006v: /dev/splunklv:8192.00:/opt/splunk ada1010v: /dev/splunklv:10112.00:/opt/splunk ada1009v: /dev/splunklv:10112.00:/opt/splunk ada1011v: /dev/hd10opt:3328.00:/opt ada1002t: /dev/hd10opt:3328.00:/opt ada1011p: /dev/splunklv:10112.00:/opt/splunk ada1018v: /dev/splunklv:30592.00:/opt/splunk ada1010q: /dev/splunklv:4096.00:/opt/splunk ada1013v: /dev/splunklv:10112.00:/opt/splunk ada1014v: /dev/splunklv:10112.00:/opt/splunk ada1015v: /dev/splunklv:4096.00:/opt/splunk ada1017v: /dev/splunklv:10112.00:/opt/splunk ada1024p: /dev/splunklv:8192.00:/opt/splunk ada1017p: /dev/splunklv:10112.00:/opt/splunk ada1019p: /dev/hd10opt:3584.00:/opt ada1023p: /dev/splunklv:10112.00:/opt/splunk ada1012v: /dev/hd10opt:3328.00:/opt ada1022p: /dev/splunklv:10112.00:/opt/splunk ada1025p: /dev/splunklv:8192.00:/opt/splunk ada1027p: /dev/splunklv:8192.00:/opt/splunk ada1018p: /dev/splunklv:10112.00:/opt/splunk ada1020p: /dev/hd10opt:4352.00:/opt ada1026p: /dev/splunklv:8192.00:/opt/splunk ~~~ ::: ## Anforderungen ### Groups / Users splunk: `splunk id=22101857 pgrp=usr groups=usr,db2dba,cadina,Edz5965p,initdadm,secadm,nvbgroup,Bde71fup,splunk,adle00bp,artadm,vbsekadm home=/home/splunk shell=/bin/sh gecos=Monitoring und Fehleranalsyse POC Splunk` **Klären** ### Sudo Berechtigungen Keine sudo Berechtigungen nötig ### VG, Logical Volumes & Filesysteme Ist eine Kategorisierung möglich/sinnvoll? - IHS 2GB - WAS 4GB - DB 8GB - Portal 10G #Interne Klärung #### Tabelle 1 | VG | LV | Mount | Owner | Group | size | |--------|------------|-------------|--------|-------|-------| |SYSMGTvg|**splunklv**| /opt/splunk | splunk | usr | 10G | :::warning **Klärung Huddle** : physical volume / LV names/size / mount point Wenn neue VG woher kommt der GP-Code für die Platten? ::: ### Service / Scripte (init.d) Existiert! (`/etc/init.d/splunk`) Muss per mkinitlnk angelegt werden! ### Netzwerk (Portfreischaltungen?) - Nötige Ports sind freigeschaltet ### Was geschieht mit bestehenden Installation? - Anpassen? - Kann ohne Bedenken gelöscht und neu installiert werden, da der Splunk sich dann automatisch die Konfigurationen neu zieht. - Wie sieht es bei WPARs aus? LVs überall vorhanden - Splunk auf ca. der Hälfte installiert :::info :memo: Interne Klärung Huddle ::: ### Pakete & Updates Mail von Stephan 16.3 - Password für admin user Siehe [Splunk](https://docs.splunk.com/Documentation/Splunk/latest/Admin/User-seedconf) - Login splunk user? - [Repo](http://adnim01b1.generali-gruppe.de/repo/software/splunk/) auf adnim01. Beispiel: `[root@lde7170p:/opt/splunk/bin]# ./splunk hash-passwd start123 $6$C9UVSvqoiTvrgpA0$tMVEp2DvjtN/sHL/BJ4XYEc9JyHNfBBtUYQNocEdQ3VVlmF5CpZcwAvQ9STh3Zk9WQIwC2nseHGkyeUHrHlZH/` :::danger Hash von Stephan abfragen ::: ### Testsysteme ada9001t - ada9009t (AIX-Intern) ### Good to know Splunk sammelt standardmäßig gar nichts und wird durch die Konfiguration um entsprechende Verzeichnisse ausgeweitet. ### Weiteres Vorgehen :::info :memo: Interne Klärung Huddle :::

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.