Set up the Splunk Add-on for JBoss

After you have installed the Splunk Add-on for JBoss, you need to configure the inputs for the add-on.

• If you want to collect local JBoss logs only, you can perform this configuration using either the Settings > Data Inputs > Files & directories page for the Splunk Add-on for JBoss or by editing the inputs.conf file directly.

• If you want to collect thread information for all threads from JBoss servers, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input.

• If you want to collect performance data from JBoss servers you need to configure a JMX connection to the JBoss server in the Splunk Add-on for JMX as described in Configure JMX inputs for the Splunk Add-on for JBoss.

Set up basic authentication using Splunk Web

Prerequisite: You need a Management User or Application User account to establish the JMX connection to the JBoss server. See Enable remote management through JMX for information.

Complete these steps to set up the Splunk Add-on for Jboss using Splunk Web:

1. In Splunk Web, navigate the Splunk Add-on for Jboss either by clicking the name of this add-on on the left navigation banner on through your Splunk platform Home page or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Jboss.
2. Go to the Jboss Account tab.
3. Click Add.
4. In the Add Account dialog box, fill in the required fields:

   Field	Description
   Name	Add a unique name for Account.
   JBoss JMX URL	Enter the URL of your Jboss instance in service:jmx:<protocol>://<ip-address>:<port> format.
   JBoss JMX username	Add server username.
   JBoss JMX password	Add server password.

5. Click Add:
   • If the entered information is authenticated successfully, the add-on saves the account information.
   • If you have entered incorrect credentials or an incorrect url, an error message appears on the dialog box. If you see such message, verify the information you have entered and try again.

Configure file monitor inputs in inputs.conf

If you would like to collect only local JBoss log files, you can edit inputs.conf directly to create the file monitor inputs instead of using the Settings > Data Inputs > Files & directories page.

If you would also like to collect thread information, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input. Splunk recommends using the below pattern for logging of the access log in order for logs to be CIM-compliant.

If you would also like to collect thread information, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input.

Splunk recommends using the below pattern for logging of the '''access log''' in order for logs to be CIM-compliant:

pattern="%t, x_forwarded_for="%{i,X-Forwarded-For}", remote_ip="%a", remote_host="%h", server="%v", server_port=%p, user="%u", http_method=%m, uri_path="%U", uri_query="%q", status=%s,  bytes_sent=%b, response_time=%D, http_content_type="%{o,Content-Type}", http_user_agent="%{i,User-Agent}", http_referrer="%{i,Referer}", url="%{i,Host}%U%q""

Also make sure to include record-request-start-time="true" in respective http-listener tag.

1. Create an inputs.conf file in $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local.

2. Add the following stanzas. Modify the directory name if necessary to use the actual directory your JBoss files are stored in.

[monitor:///root/EAP-7.4.0/standalone/log/server.log*] 
disabled = false
followTail = false
index = main
sourcetype = jboss:server:log
 
[monitor:///root/EAP-7.4.0/standalone/log/*gc.log*]
disabled = false
followTail = false
index = main
sourcetype = jboss:gc:log

[monitor:///root/EAP-7.4.0/standalone/log/access.log*]
disabled = false
followTail = false
index = main
sourcetype = jboss:access:log

Note: The path of the log files may vary according to the configuration in the Jboss server.

3. Save the file.

4. Restart the Splunk platform to put these configuration changes into effect.

Next, validate that the data inputs were created.

Optional Splunk Web configurations

Configure logging level using Splunk Web

1. Go to the Splunk Add-on for Jboss's landing page, either by clicking the name of this add-on on the left navigation banner on your on the Splunk software's home page or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for JBoss.
2. Click the Configuration tab.
3. Go to the Logging tab.
4. (Optional) If you want to change the logging level, select a new level from the drop-down menu.
5. Click Save to save your configurations.

Set up the add-on using configuration files

Prerequisites

• Only users with file system access, such as system administrators, can set up the Splunk Add-on for Jboss using configuration files.
• Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.

Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.

Steps

Complete these steps to set up the Splunk Add-on for Jboss using configuration files:

1. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_jboss and create a /local directory if it does not already exist.
2. Create a file called splunk_ta_jboss_account.conf in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local directory.
3. For each unique account name you want to keep, create a stanza. Make the stanza name same as the account name:

Stanza	Setting	Description
[account_name]	jmx_url	JMX URL to connect to the JBoss server of the form service:jmx:<protocol>://<ip-address>:<port>
	username	Username of the JBoss server
	password	Password of the JBoss server

4. Review the values for the settings in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/default/splunk_ta_jboss_settings.conf file. The values for the settings are listed in the following table. To use different values, create a file called splunk_ta_jboss_settings.conf in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local directory. Add only the stanzas and settings that you want to change to the file in the local directory.

   Stanza	Setting	Description
   [logging]	loglevel	Specifies the verbosity of the logs. Default is INFO. Log level can be DEBUG, INFO or ERROR.

5. Save your changes.
6. Restart your Splunk instance.

If you have multiple search heads that are not in a search head cluster, perform these preceding steps on each search head to support search-time push integration. Configure data collection only on your data collection nodes, typically one or more heavy forwarders.