Configure IBM WebSphere to produce data for the Splunk Add-on for IBM WebSphere Application Server

The Splunk Add-on for IBM WebSphere Application Server allows you to collect three different data types from your WAS instances:

• server file system logs
• HPEL interface logs for applications
• JMX metrics

You need to configure your IBM WebSphere application servers to produce these logs using the WebSphere administrative console.

Enable server file system logs

Enable PMI metrics

You can configure Performance Monitoring Infrastructure (PMI) metrics in IBM WebSphere to control the number of Mbeans the Splunk Add-on for IBM WebSphere Application Server can collect. Although the basic Mbeans used for AppServer data model mapping for ITSI can be retrieved without enabling PMI metrics in IBM WebSphere, you can collect additional Mbeans by configuring PMI according to your needs.

To enable all PMI metrics, log in to the WebSphere administrative console and navigate to Servers > Server Types > WebSphere application servers > <server_name>. Click the Configuration tab then click Performance Monitoring Infrastructure (PMI). Check Enable Performance Monitoring Infrastructure and select All under Currently monitored statistic set.

For more information about enabling PMI, see https://www.ibm.com/support/knowledgecenter/en/SSEQTP_9.0.5/com.ibm.websphere.base.doc/ae/tprf_prfstartadmin.html.

Enable verbose garbage collection

Log in to the WebSphere administrative console and navigate to the Java Virtual Machine: Servers > Server Types > WebSphere application servers ><server_name> > Server Infrastructure > Java and Process Management > Process definition > Java Virtual Machine. Enable verbose garbage collection and specify the gc.log file path. The log path must be under the ${SERVER_LOG_ROOT} directory. For example: /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1. For more information, see the IBM documentation: http://www-01.ibm.com/support/docview.wss?uid=swg21114927.

To monitor verbose garbage collection files, you can enable the following default stanza provided in the add-on:

On Windows environments, enable the following stanza: [monitor://$WASHOME\...\*gc.*log]

On Linux/Unix environments, enable the following stanza: [monitor://$WASHOME/.../*gc.*log]

Note: If you were using the old stanzas, such as "[monitor://$WASHOME\...\*gc.log] (for Windows) and [monitor://$WASHOME/.../*gc.log] (for Linux)" to monitor garbage collection logs, and you've upgraded to IBM WAS version 8 or greater, Splunk best practice is to use the default stanzas that correspond with IBM's latest file name convention.

Enable http access logging and http error logging

Login into the WebSphere administrative console and navigate to Servers > Server Types > WebSphere application servers > <server_name> >Troubleshooting > NSCA access and HTTP error logging. On the NSCA access and HTTP error logging screen, enable the following:

• Enable logging service at server start-up
• Enable access logging
• Enable error logging

Turn on HPEL logging

To turn on High Performance Extensible Logging (HPEL) logging for your WebSphere applications, follow the instructions in the IBM documentation that match your WAS version. This link leads to instructions for version 8.5.5: http://www-01.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.multiplatform.doc/ae/ttrb_compToHPEL.html?cp=SSAW57_8.5.5.

Enable JMX in WebSphere

To extract JMX metrics for your WebSphere application server using the Splunk Add-on for JMX, you must first enable the JMX connector in WebSphere. Follow this detailed walkthrough for instructions on how to do this in WebSphere version 8.5: https://www.splunk.com/en_us/blog/tips-and-tricks/enabling-jmx-in-websphere-application-server.html.