Eventgen testing

Testing Nmon performance with evengen

Splunk Evengen is a pretty good and straightforward way to test the application.

Starting the TA-nmon version 1.3.28 and TA-nmon-hec version 1.3.32, we provide sample data for 2 AIX and 2 Linux servers. The data has been generated on IBM Power Development Cloud servers.

Finally, we use to run a system stress tool on 1 server of each category, such that you will have quickly active alerts and system statistic anomalies.

Eventgen will generate data for:

  • performance metrics (sourcetype=nmon_data / eventtype=nmon:performance)
  • configuration data (sourcetype=nmon_config / eventtype-nmon:config)

Additional data normally available within the application is related to the nmon data collection and will not be generated by Eventgen.

Get it working in 30 seconds

  • Have a Splunk instance up and running
  • Download the current eventgen version from https://github.com/splunk/eventgen
  • Install the eventgen application, you should name the application directory as:
$SPLUNK_HOME/etc/apps/SA-Eventgen
  • If not done already, install the Nmon Performance application (obvious!)
  • Install either the TA-nmon or the TA-nmon-hec on this instance
  • Create an index called “nmon”
  • Restart Splunk

Immediately after Splunk restart, eventgen starts to generate nmon data, as visible from the application home page:

eventgen_testing.png

Example of a server running with abnormal load:

eventgen_testing2.png