Configure Operating System properties

You can configure operating system properties to improve that stability of your data collection nodes in a production environment. These configuration changes are optional.

Set static IP addresses

You can set a static IP address for the data collection node. DHCP (dynamic addressing) can cause the collection node's IP address to vary over time, which results in unexpected behavior. Making a connection to a specific collection node can become difficult (especially if DNS is down). If you want to connect to the collection node to perform maintenance or to determine which collection node is sending data, setting a status IP address makes connecting to the node easier.

Log in as the splunkadmin user to make changes to the data collection node.

Change the NTP server pool list

The Network Time Protocol (NTP) is used to synchronize a computer's time with another reference time source. Most *Nix systems provide you with the ability to set up or change time synchronization.

You can change the NTP servers that your data collection node uses by editing the /etc/ntp.conf file.

The default values for the servers in /etc/ntp.conf are:

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.centos.pool.ntp.org
server 1.centos.pool.ntp.org
server 2.centos.pool.ntp.org

To use different NTP servers, replace the default values in the file with your specific values. Restart ntpd for the changes to take effect.

sudo service ntpd restart

Disable NTP on the data collection node

If you do not have access to the internet you can disable NTP on the data collection node. This can happen when you operate behind a firewall that precludes access to the Internet. If you disable NTP, re-enable VMware Tools Clock Synchronization which gets the data collection node's time from the underlying ESXi host. Log in and execute the following commands as the splunkadmin user:

1. Stop ntpd service and configure it so that it does not run at system startup:

   sudo service ntpd stop

   sudo chkconfig ntpd off

2. Enable timesync:

   vmware-toolbox-cmd timesync enable

3. Check that timesync is enabled correctly:

   vmware-toolbox-cmd timesync status