Troubleshoot the Web Server Module

See information below for troubleshooting information specific to the ITSI Web Server Module. For more information, see Troubleshooting modules.

Minicharts for Storage, Memory, and CPU in the drilldown are not displaying results

Minicharts that fail to display results in the drill down can occur due to one of the following issues:

• You are running a version of ITSI that does not have the Operating System (OS) module installed. The saved searches that the minicharts use are stored within the context of the OS module. Upgrade to ITSI version 2.1 and above to fix this issue.
• You do not have the Splunk Add-On for Windows or the Splunk Add-On for Unix and Linux installed. These are the applications that send data about OS metrics into the indexer. Install the Splunk Add-On for Windows or the Splunk Add-On for Unix and Linux to enable minichart display results.

Error tab doesn't have any information on the panels

The Error tab displays web server errors that occur within Apache, and not the site serving content.

Error log related searches are different from HTTP errors (4xx, 5xx).

To fix this issue, perform the following steps:

1. Navigate to your data input configurations.
2. Add the files/directories that correspond to your deployment's error logs.
3. Assign the correct source types.
4. Click Save.

Configure your Apache Web Server to display log events in a format Splunk platform can read

Configure your Apache Web Server deployment to format log events in a format that can be read by the Splunk Add-on for Apache Web Server.

1. Navigate to the apache httpd.conf file in your Apache deployment (Example: /etc/apache/httpd.conf).
2. Navigate to the statement <IfModule log_config_module> in your apache httpd.conf file, and replace the file contents with the below stanza:
   

    <IfModule log_config_module>
   
       #
   
       # The following directives define some format nicknames for use with
   
       # a CustomLog directive (see below).
   
       #
   
       LogFormat "%h %v %l %u %{local}p %t \"%r\" \"%q\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O %D" combined
   
       LogFormat "%h %l %u %t \"%r\" %>s %b" common
   
       <IfModule logio_module>
   
         # You need to enable mod_logio.c to use %I and %O
   
         LogFormat "%h  %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
   
       </IfModule>
   
       #
   
       # The location and format of the access logfile (Common Logfile Format).
   
       # If you do not define any access logfiles within a <VirtualHost>
   
       # container, they will be logged here.  Contrariwise, if you *do*
   
       # define per-<VirtualHost> access logfiles, transactions will be
   
       # logged therein and *not* in this file.
   
       #
   
       # CustomLog "logs/access_log" common
   
       #
   
       # If you prefer a logfile with access, agent, and referer information
   
       # (Combined Logfile Format) you can use the following directive.
   
       #
   
       CustomLog "logs/access_log" combined
   
   </IfModule>
   
   

3. Restart your Apache server.