Configure Splunk Add-on for VMware performance data collection

This topic discusses how to improve the performance of the vCenter server when you see performance issues during data collection.

You can limit the processing (reduce the memory and cpu load) on the vCenter server during data collection when you see performance issues with your vCenter server. How performance data is collected in the Splunk Add-on for VMware is specified in the file ta_vmware_collection.conf. The parameter perf_format_type is set to one of two modes:

• csv mode. The response from the ESXi host when collecting performance data is parsed by vCenter. Performance data is collected by the Splunk Addon for VMware, from vCenter, by default, using csv mode.
• normal mode. The response from the ESXi host when collecting performance data is parsed by the data collection nodes. This reduces the load on vCenter.

To change modes, edit a local version of etc/apps/Splunk_TA_vmware/default/ta_vmware_collection.conf, and change the value of perf_format_type to normal. Processing performance data is now done on the data collection node.

Change data collection node capabilities and log levels

Change DCN capabilities

At the node level, hydra_node.conf contains the capabilities field. The Collection Configuration page sets the capabilities of the workers on the data collection nodes. You can change the capabilities for a node.

The capabilities in hydra_node.conf can be changed by the data collection node to only include certain tasks. For example, if two data collection nodes are specified in hydra_node.conf, one data collection node can require more power and more memory to process more intensive tasks than the other data collection node. The capabilities are specified by the following lines in hydra_node.conf:

[dcn1:8089]
capabilities = hostinv, vminv
[dcn2:8089]
capabilities = task, event

1. Create a local version of hydra_node.conf.
2. Edit $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_node.conf on the scheduler node to adjust the capabilities.

[default]

gateway_port = 8008

capabilities = * 


Change DCN log levels

To troubleshoot your environment, you can set the field worker_log_level in hydra_node.conf for a data collection node.

1. On the Collection Configuration page, create a local version of hydra_node.conf.
2. Edit $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_node.conf to set the log level of for all data collection nodes. The default log level for a data collection node is INFO. The most verbose logging level is DEBUG.

Example:

[default]

gateway_port = 8008

capabilities = * 

worker_log_level = DEBUG