Skip to content

Overview ↵

About the Splunk Add-on for JBoss
Version 3.1.1
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2, 7.3 and 7.4
Add-on has a web UI Yes

Release notes

For a summary of new features, fixed issues, and known issues, and for more information on release history, see Release notes for the Splunk Add-on for JBoss.

Compatibility

The Splunk Add-on for JBoss allows a Splunk software administrator to collect JBoss file system logs from a local JBoss server and performance metrics from MBean attributes and operations from local and remote JBoss servers. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

For detailed information about compatibility with other software, CIM versions, and platforms, see Release notes for the Splunk Add-on for JBoss.

Source types and lookups

For more information about the source types for Splunk Add-on for JBoss, see Source types.

Download the add-on

Download the Splunk Add-on for JBoss from Splunkbase.

Install and configure the add-on

To install and configure the Splunk Add-on for JBoss, see Installation and configuration overview for the Splunk Add-on for JBoss.

Note

You must also install and configure the Splunk Add-on for Java Management Extensions (JMX) if you want to collect JBoss performance data provided by MBean attributes.

Hardware and software requirements

For more information, see Hardware and software requirements.

Additional resources

See the Splunk Community page for questions related to Splunk Add-on for JBoss.

See Troubleshooting guidelines specific for this add-on.

Hardware and software requirements for the Splunk Add-on for JBoss

Prerequisites

The Splunk Add-on for JBoss supports multiple data inputs, each capable of collecting different data from your JBoss application servers. For more information about which kind of data you can collect with which input, refer to the source types page.

The OpenJDK Java Runtime or Oracle Java Runtime is required in order to collect JBoss server thread information and JBoss server performance metrics through the Splunk Add-on for Java Management Extensions (JMX).

Collect local log files

If you want to collect local JBoss log files, you must install a universal or heavy forwarder or single instance directly on the machine running your JBoss server, so it can access the logs locally.

Enable the logs you want to collect on the JBoss server.

For instructions on enabling the server log (server.log), see the JBoss documentation at https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html/configuration_guide/logging_with_jboss_eap#bootup_logging.

For instructions on enabling the garbage collection log (gc.log), see the JBoss documentation at https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html/configuration_guide/logging_with_jboss_eap#garbage_colleciton_logging.

For instructions on enabling the access log (access.log), see the JBoss documentation at https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html/configuration_guide/configuring_the_web_server_undertow#access_logging.

Collect thread information

You must complete the following steps to collect JBoss server thread information from MBean operations:

  1. Install Java Runtime 1.7 or later on the same machine as the Splunk Add-on for JBoss.

Note

You need to use the OpenJDK Java Runtime or Oracle Java Runtime.

  1. Enable remote management through JMX on the JBoss servers for which you would like to collect thread information. This enables the Splunk Add-on for JBoss to make the JMX connection to the JBoss server. Follow the instructions in the Enable remote management through JMX section on this page.

Collect performance metrics from MBean attributes

You must complete the following steps to collect JBoss server performance metrics from MBean attributes:

  1. Install the latest version of the Splunk Add-on for Java Management Extensions (JMX). See the Splunk Add-on for Java Management Extensions documentation for installation and configuration information.

  2. Install Java Runtime 1.7 or later on the same machine as the Splunk Add-on for JBoss.

    Note

    You need to use the OpenJDK Java Runtime or Oracle Java Runtime.

  3. Enable remote management through JMX on the JBoss servers for which you would like to collect performance metrics. This enables the Splunk Add-on for JMX to make the JMX connection to the JBoss server. Follow the instructions in the following section.

Enable remote management through JMX

You need to create a Management User if you are running JBoss EAP in standalone server mode or create both a Management User and an Application User if you are running JBoss EAP in managed domain mode.

  • To be able to authenticate with the remote host controller, create a Management User using the EAP_HOME/bin/add-user.sh script.

  • If you are using the managed domain operating mode, in order to authenticate with the remote server, also create an Application User using the EAP_HOME/bin/add-user.sh script.

For standalone mode, run the following command:

EAP_HOME/bin/standalone.sh -Djboss.bind.address=ip -Djboss.bind.address.management=ip

For managed domain mode, run the following command:

EAP_HOME/bin/domain.sh -Djboss.bind.address=ip -Djboss.bind.address.management=ip.

Note

Specify the IP address to enable remote access.

You should now be able connect to the remote instance using the Management User account. The connection string looks similar to this:

service:jmx:remoting-jmx://<IP_Address>:9999 (JBoss EAP 6.x server)

service:jmx:remote+http://<IP_Address>:9990 (JBoss EAP 7.x server)

For managed domain mode, edit the EAP_HOME/bin/domain.xml and uncomment the following line from the profile to enable it.

<remoting-connector use-management-endpoint="false"/>

This enables you to connect to the remote server using the Application User account.

For more information about JBoss EAP user management, see the JBoss documentation at https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/configuration_guide/jboss_eap_management#management_users.

Splunk platform requirements

Because this add-on runs on the Splunk platform, all of the system requirements apply for the Splunk software that you use to run this add-on.

  • For Splunk Enterprise system requirements: see System Requirements in the Splunk Enterprise Installation Manual.
  • If you are managing on-premises forwarders to get data into Splunk Cloud, see System Requirements in the Splunk Enterprise Installation Manual, which includes information about forwarders.

Release notes for the Splunk Add-on for JBoss

Version 3.1.1 of the Splunk Add-on for JBoss was released on November 27, 2024.

About this release

Version 3.1.1 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 9.1.x, 9.2.x, 9.3.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 3.1.1 of the Splunk Add-on for JBoss has the following new features:

  • Fixed the following vulnerabilities:
  • CVE-2023-5685
  • CVE-2022-3143
  • CVE-2020-10718
  • CVE-2019-19343
  • CVE-2024-47554
  • Fixed the issue related to outdated jar files accumulation in libs folder.

Fixed issues

Version 3.1.1 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.1.1 of the Splunk Add-on for JBoss has the following known issues.

Release history for the Splunk Add-on for JBoss

Latest release

The latest version of the Splunk Add-on for JBoss is version 3.1.1. See Release notes for the Splunk Add-on for JBoss for the release notes of this latest version.

Version 3.1.0

Version 3.1.0 of the Splunk Add-on for JBoss was released on August 23, 2024.

Compatibility

Version 3.1.0 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 9.1.x, 9.2.x, 9.3.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.1.0 of the Splunk Add-on for JBoss has the following new features:

  • Support for IPv6
  • The Splunk add-on for JBoss version 3.1.0 is now compatible with Splunk running on IPv6 environments.
  • Support for Python 3.9
  • Fixed security vulnerabilities found in the certifi, urllib3 and idna libraries by upgrading their version from:
    • 2024.2.2 to 2024.7.4
    • 1.26.18 to 1.26.19
    • 3.6 to 3.1.0

Fixed issues

Version 3.1.0 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.1.0 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.6

Compatibility

Version 3.0.6 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 9.0.x, 9.1.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.6 of the Splunk Add-on for JBoss has the following new features:

  • Fixed the security vulnerabilities found in the certifi and urllib3 libraries by upgrading its version from 2022.12.7 to 2023.11.17 and 1.26.6 to 1.26.18.

Fixed issues

Version 3.0.6 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.6 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.5

Version 3.0.5 of the Splunk Add-on for JBoss was released on February 22, 2023.

Compatibility

Version 3.0.5 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.1, 8.2, 9.0.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.5 of the Splunk Add-on for JBoss has the following new features:

  • Upgraded the third-party certifi library to version 2022.12.7
  • Fixed a security vulnerability found in the certifi library.

Fixed issues

Version 3.0.5 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.5 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.4

Version 3.0.4 of the Splunk Add-on for JBoss was released on Nov 7, 2022.

Compatibility

Version 3.0.4 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.1, 8.2, 9.0.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.4 of the Splunk Add-on for JBoss has the following new features:

  • Fixed a security vulnerability found in the commons-text library by upgrading its version from 1.9.0 to 1.10.0

Fixed issues

Version 3.0.4 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.4 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.3

Version 3.0.3 of the Splunk Add-on for JBoss was released on Aug 5, 2022.

Compatibility

Version 3.0.3 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.1, 8.2, 9.0.x
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.3 of the Splunk Add-on for JBoss has the following new features:

  • Fixed multiple security vulnerabilities found in the fastjson, commons-configuration2 and log4j libraries.
  • Upgraded the fastjson library from version 1.2.78 to 1.2.83.
  • Upgraded the log4j library from version 2.16.0 to 2.18.0.
  • Upgraded the commons-configuration2 library from version 2.7 to 2.8.0.

Fixed issues

Version 3.0.3 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.3 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.2

Version 3.0.2 of the Splunk Add-on for JBoss was released on December 17, 2021.

Compatibility

Version 3.0.2 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.0, 8.1, 8.2
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.2 of the Splunk Add-on for JBoss has the following new features:

  • Upgraded the log4j library from version 2.15.0 to 2.16.0.
  • Fixed a security vulnerability found in the log4j library

Fixed issues

Version 3.0.2 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.2 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.1

Version 3.0.1 of the Splunk Add-on for JBoss was released on December 15, 2021.

Compatibility

Version 3.0.1 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.0, 8.1, 8.2
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.1 of the Splunk Add-on for JBoss has the following new features:

  • Fixed a security vulnerability found in the log4j library.

Fixed issues

Version 3.0.1 of the Splunk Add-on for JBoss has the following, if any, fixed issues.

Known issues

Version 3.0.1 of the Splunk Add-on for JBoss has the following known issues.

Version 3.0.0

Version 3.0.0 of the Splunk Add-on for JBoss was released on October 4, 2021.

Compatibility

Version 3.0.0 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 8.0, 8.1, 8.2
CIM 4.20.0
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2,7.3 and 7.4

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 3.0.0 of the Splunk Add-on for JBoss has the following new features:

  • Migrated the TA from setup page to latest UCC version i.e 5.x
  • Support of the JBoss EAP server v7.4
  • Support of the access log in the TA
  • Support of multiple accounts and multiple inputs
  • Removed python2 support from the add-on and dropped the support for Splunk 7.x
  • Provided server validation while configuring the account on the configuration page
  • Common Information Model (CIM) version 4.20.0 compatibility

Fixed issues

Version 3.0.0 of the Splunk Add-on for JBoss has no fixed issues.

Known issues

Version 3.0.0 of the Splunk Add-on for JBoss has the following known issues.

Version 2.1.0

Compatibility

Version 2.1.0 of the Splunk Add-on for JBoss was released on February 2, 2021. Version 2.1.0 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 7.2, 7.3, 8.0, 8.1
CIM 4.18
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.4, 7.2 and 7.3

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.1.0 of the Splunk Add-on for JBoss has the following new features:

  • Support of JBoss EAP version 7.2 and 7.3
  • Support of OpenJDK 11 and OracleJDK 11
  • Common Information Model (CIM) version 4.18 compatibility

Fixed issues

Version 2.1.0 of the Splunk Add-on for JBoss has no fixed issues.

Known issues

Version 2.1.0 of the Splunk Add-on for JBoss has the following known issues.

Version 2.0.1

Version 2.0.1 of the Splunk Add-on for JBoss was released on March 14, 2020.

Compatibility

Version 2.0.1 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 7.0.x, 7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM 4.2.0 or later
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.x

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.

New features

Version 2.0.1 of the Splunk Add-on for JBoss has the following new features:

  • Default support for Python3.

Fixed issues

Version 2.0.1 of the Splunk Add-on for JBoss has no fixed issues.

Known issues

Version 2.0.1 of the Splunk Add-on for JBoss has the following known issues.

Version 2.0.0

Version 2.0.0 of the Splunk Add-on for JBoss was released on October 21, 2019.

Compatibility

Version 2.0.0 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 7.0.x, 7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM 4.2.0 or later
Platforms Platform Independent
Vendor Products JBoss Enterprise Application Platform (EAP) 6.x

New features

Version 2.0.0 of the Splunk Add-on for JBoss has the following new features:

  • Python 3 compatibility.

Fixed issues

Version 2.0.0 of the Splunk Add-on for JBoss has no fixed issues.

Known issues

Version 2.0.0 of the Splunk Add-on for JBoss has the following known issues.

Version 1.0.0

Version 1.0.0 of the Splunk Add-on for JBoss was released on November 16, 2015.

Compatibility

Version 1.0.0 of the Splunk Add-on for JBoss is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk software versions 6.5.x, 6.6.x, 7.0.x, 7.1.x, 7.2.x
CIM 4.2 or later
Platforms Windows and Linux
Vendor Products JBoss Enterprise Application Platform (EAP) 6.x

New features

Version 1.0.0 of the Splunk Add-on for JBoss has the following new features.

  • Create a new add-on for Red Hat JBoss EAP.

Known issues

Version 1.0.0 of the Splunk Add-on for JBoss has the following known issues.

Third-party software attribution

A complete listing of third-party software information for this add-on is available as a text edit file for download: Third-party credits.

Installation overview for the Splunk Add-on for JBoss

Follow these steps to install and configure this add-on on your supported platform:

  1. Download the add-on from Splunkbase.

  2. If you want to collect performance metrics, install the latest version of Splunk Add-on for Java Management Extensions (JMX) on the Splunk Enterprise instance responsible for JMX data collection, usually a heavy forwarder.

  3. Install the Splunk Add-On for JBoss.

  4. Set up the Splunk Add-on for JBoss to configure the account, logging and monitor inputs for local logs.

  5. Configure dumpAllThreads inputs for the Splunk Add-on for JBoss.

  6. If collecting performance metrics, configure JMX inputs for the Splunk Add-on for JBoss.

Ended: Overview

Installation ↵

Install the Splunk Add-on for JBoss

Use the tables on this page to determine where and how to install this add-on in a distributed deployment of Splunk Enterprise. See the installation walkthrough section at the bottom of this page for links to installation instructions specific to a single-instance deployment, distributed deployment, or Splunk Cloud.

Inputs for the Splunk Add-on for JBoss

There are three different inputs in this add-on. You can choose to use one or several of them. Keep these requirements in mind as you choose how to install the add-on in your environment.

  • If you plan to gather logs from a local JBoss server (access.log, server.log and gc.log) which are collected via file monitoring, the heavy forwarder or single-instance Splunk Enterprise doing the data collection must be installed directly on the JBoss server.
  • The modular input for thread information must be enabled on a heavy forwarder or single-instance Splunk Enterprise.
  • The JMX input for performance data depends on the Splunk Add-on for JMX, which must be installed on a heavy forwarder or single-instance Splunk Enterprise.

Distributed installation of this add-on

This table provides a quick reference for installing this add-on to a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Required Comments
Search Heads Yes Yes Install this add-on to all search heads where JBoss knowledge management is required.
Indexers Yes Conditional Not required if you use heavy forwarders to monitor JBoss log files directly on JBoss machines. Required if you use universal forwarders for monitor inputs.
Heavy Forwarders Yes Yes This add-on requires heavy forwarders to perform data collection via JMX and modular inputs.
Universal Forwarders Yes No Supported for monitor inputs only. You must also install this add-on on your indexers if you use a universal forwarder rather than a heavy forwarder to monitor JBoss log files.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes You can install this add-on on a search head cluster for all search-time functionality, but only configure inputs on forwarders to avoid duplicate data collection.
Before installing this add-on to a cluster, make the following changes to the add-on package:
1. If the eventgen.conf file is present in your installation package, remove it along with any files in the Samples folder.
2. If the inputs.conf file is present in your installation package, remove the file.
Indexer Clusters Yes Before installing this add-on to a cluster, make the following changes to the add-on package:
1. If the eventgen.conf file is present in your installation package, remove it along with any files in the Samples folder.
2. If the inputs.conf file is present in your installation package, remove the file.
Deployment Server Yes Note:.

Using a deployment server to deploy the configured add-on to multiple forwarders acting as data collectors may cause duplication of data if multiple forwarders are collecting data from the same remote Jboss server.
 The add-on uses the credential vault to secure your credentials, and this credential management solution is incompatible with the deployment server. Make sure that the deployment server and forwarder uses the same credential vault. Alternatively, configure the add-on on the deployment server with Jboss credentials in plain text and after pushing the configured add-on to the forwarder, the credentials would be encrypted.

Installation walkthrough

See Installing add-ons in the Splunk Add-Ons documentation for detailed instructions describing how to install a Splunk add-on in the following deployment scenarios:

Upgrade the Splunk Add-on for Jboss

To upgrade Splunk Add-on for Jboss from v2.1.0 to v3.0.0:

  1. In Splunk Web, navigate to Settings > Data Inputs and select Splunk Add-on for JBoss.
  2. Disable the inputs configured in your existing version of the Splunk Add-on for Jboss.
  3. Upgrade the add-on to version v3.0.0 either by clicking the Upgrade button, or by following the installation steps in the Install topic of this manual.
  4. In Splunk Web, navigate to the Splunk Add-on for Jboss.
  5. On the Splunk Add-on for Jboss configuration page, navigate to the Account tab, by clicking Configuration > Account. Configure your Jboss account, see the Set up the Splunk Add-on for JBoss topic in this manual for more information.
  6. Navigate to the Inputs page, by clicking Inputs tab.
  7. Add the account you have configured by editing the dumpAllThreads input.
  8. Enable the reconfigured dumpAllThreads input.

Ended: Installation

Configuration ↵

Set up the Splunk Add-on for JBoss

After you have installed the Splunk Add-on for JBoss, you need to configure the inputs for the add-on.

  • If you want to collect local JBoss logs only, you can perform this configuration using either the Settings > Data Inputs > Files & directories page for the Splunk Add-on for JBoss or by editing the inputs.conf file directly.

  • If you want to collect thread information for all threads from JBoss servers, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input.

  • If you want to collect performance data from JBoss servers you need to configure a JMX connection to the JBoss server in the Splunk Add-on for JMX as described in Configure JMX inputs for the Splunk Add-on for JBoss.

Set up basic authentication using Splunk Web

Prerequisite

You need a Management User or Application User account to establish the JMX connection to the JBoss server. See Enable remote management through JMX for information.

Complete these steps to set up the Splunk Add-on for Jboss using Splunk Web:

  1. In Splunk Web, navigate the Splunk Add-on for Jboss using one of the following methods:
  • on your Splunk Platform home page, from the lef-side navigation page, select the the add-on
  • go to Manage Apps, then select Launch App in the row for the Splunk Add-on for Jboss.
  1. Go to the Jboss Account tab.
  2. Select Add.

  3. In the Add Account dialog box, fill in the required fields:

    Field Description
    Name Add a unique name for Account.
    JBoss JMX URL Enter the URL of your Jboss instance in service:jmx:://: format.
    JBoss JMX username Add server username.
    JBoss JMX password Add server password.

  4. Click Add:

    • If the entered information is authenticated successfully, the add-on saves the account information.
    • If you have entered incorrect credentials or an incorrect url, an error message appears on the dialog box. If you see such message, verify the information you have entered and try again.

Configure file monitor inputs in inputs.conf

If you want to collect only local JBoss log files, you can edit inputs.conf directly to create the file monitor inputs instead of using the Settings > Data Inputs > Files & directories page.

If you want also to collect thread information, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input. Use the following pattern for logging of the access log in order for logs to be CIM-compliant.

Note

If you would also like to collect thread information, you must use the Splunk Add-on for JBoss Input/Configuration page to configure the dumpAllThreads input.

Note

Use the following pattern for logging of the ‘’‘access log’‘’ in order for logs to be CIM-compliant:

pattern="%t, x_forwarded_for="%{i,X-Forwarded-For}", remote_ip="%a", remote_host="%h", server="%v", server_port=%p, user="%u", http_method=%m, uri_path="%U", uri_query="%q", status=%s,  bytes_sent=%b, response_time=%D, http_content_type="%{o,Content-Type}", http_user_agent="%{i,User-Agent}", http_referrer="%{i,Referer}", url="%{i,Host}%U%q""

Make sure to include record-request-start-time=”true” in respective http-listener tag.

  1. Create an inputs.conf file in $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local.

  2. Add the following stanzas. Modify the directory name if necessary to use the actual directory your JBoss files are stored in.

[monitor:///root/EAP-7.4.0/standalone/log/server.log*] disabled = false followTail = false index = main sourcetype = jboss:server:log   [monitor:///root/EAP-7.4.0/standalone/log/*gc.log*] disabled = false followTail = false index = main sourcetype = jboss:gc:log [monitor:///root/EAP-7.4.0/standalone/log/access.log*] disabled = false followTail = false index = main sourcetype = jboss:access:log

Note

The path of the log files may vary according to the configuration in the Jboss server.

  1. Save the file.

  2. Restart the Splunk platform to put these configuration changes into effect.

Next, validate that the data inputs were created.

Optional Splunk Web configurations

Configure logging level using Splunk Web

  1. In Splunk Web, navigate the Splunk Add-on for Jboss using one of the following methods:
  • on your Splunk Platform home page, from the lef-side navigation page, select the the add-on
  • go to Manage Apps, then select Launch App in the row for the Splunk Add-on for Jboss.
  1. Go to the Configuration tab.
  2. Go to the Logging tab.
  3. (Optional) If you want to change the logging level, select a new level from the drop-down menu.
  4. Click Save to save your configurations.

Set up the add-on using configuration files

Prerequisites

  • Only users with file system access, such as system administrators, can set up the Splunk Add-on for Jboss using configuration files.
  • Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.

Caution

Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.

Complete these steps to set up the Splunk Add-on for Jboss using configuration files:

  1. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_jboss and create a /local directory if it does not already exist.
  2. Create a file called splunk_ta_jboss_account.conf in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local directory.
  3. For each unique account name you want to keep, create a stanza. Make the stanza name same as the account name:
Stanza Setting Description
[account_name] jmx_url JMX URL to connect to the JBoss server of the form service:jmx:://:
[account_name] username Username of the JBoss server
[account_name] password Password of the JBoss server

  1. Review the values for the settings in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/default/splunk_ta_jboss_settings.conf file. The values for the settings are listed in the following table. To use different values, create a file called splunk_ta_jboss_settings.conf in the $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local directory. Add only the stanzas and settings that you want to change to the file in the local directory.

    Stanza Setting Description
    [logging] loglevel Specifies the verbosity of the logs. Default is INFO. Log level can be DEBUG, INFO or ERROR.

  2. Save your changes.

  3. Restart your Splunk instance.

If you have multiple search heads that are not in a search head cluster, perform these preceding steps on each search head to support search-time push integration. Configure data collection only on your data collection nodes, typically one or more heavy forwarders.

Configure dumpAllThreads inputs for the Splunk Add-on for JBoss

Configure inputs for the Splunk Add-on for Jboss using Splunk Web or through configuration files using the information in the following input parameters tables.

After you configured the account, configure your inputs to collect data. Configure inputs on your data collection node, usually a heavy forwarder.

Configure Jboss inputs via Splunk web

  1. In the Splunk Add-on for Jboss, select the Inputs tab.
  2. Click Create New Input.

  3. In the Add Input box, complete the following fields:

    Field Description
    Name Enter a unique name for the input.
    JBoss Account Enter your Jboss account name.
    Collection Interval The data collection interval, in seconds.
    Index The index that stores the collected data from this input. The default index is main.

  4. Click Save.

Configure Jboss inputs through inputs.conf

To configure inputs manually in inputs.conf, create stanzas using the following parameters and add them to $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/local/inputs.conf. If the file or path does not exist, create it.

[jboss://<name>] account = <string> object_name = java.lang:type=Threading operation_name = dumpAllThreads signature = boolean, boolean params = true, true split_array = true duration = <integer>

If you want to use the default inputs, the default value of the inputs can be found in $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/default/inputs.conf. You can copy the file to the local folder and edit it using the parameters table below.

Input parameters

Each attribute in the following table corresponds to a field in Splunk Web:

Attribute Corresponding field in Splunk Web Description
account Jboss Account Account from which data is to be collected.
object_name ObjectName The object name of the MBean on which the method is to be invoked. Supported is java.lang:type=Threading
operation_name OperationName The name of the operation to be invoked. Supported is dumpAllThreads
signature Signature Enter the java data types separated by comma. Supported is boolean, boolean
params Parameters Enter the values for the data types(entered in Signature) separated by comma. Supported is true, true
split_array SplitArray False] True to split up the whole data chunk into events and false if otherwise. Supported is true
duration Collection Interval Collection interval at which the data should be collected.
index Index The index in which to store Jboss input data. The default is default.

Validate file monitoring inputs

Validate that file monitoring inputs have been successfully created.

  1. Go to Settings > Data inputs > Files & directories.

  2. Click App in the column headings to organize the results by app name, then scroll to Splunk_TA_jboss in that column.

  3. Review the files being monitored to ensure it is as you expect. They should be enabled by default.

Note

If you subsequently change the directory in which the log files are stored, generate new file monitoring inputs for the new location by using Settings > Data inputs > Files & directories page or update the local copy of inputs.conf file.

Validate data collection

To verify the add-on has been installed successfully and that all expected data is being ingested into the Splunk platform, run the following searches depending on which inputs you have configured.

Performance data and thread information:

Search

sourcetype=jboss:jmx

server.log:

Search

sourcetype=jboss:server:log

gc.log:

Search

sourcetype=jboss:gc:log

access.log:

Search

sourcetype=jboss:access:log

Configure JMX inputs for the Splunk Add-on for JBoss

The Splunk Add-on for JBoss relies on the Splunk Add-on for JMX to collect performance metrics for local or remote JBoss servers using MBean attributes. The Splunk Add-on for JBoss provides a jmx_templates.conf that the Splunk Add-on for JMX can invoke.

If you do not want to collect performance metrics for the JBoss server and only want to collect local logs or thread information from JMX MBean operations, you do not need to perform this configuration.

Prerequisite: You msust install Java Runtime 1.7 or later on the same machine as the Splunk Add-on for JMX. You also need to create a Management User or Application User to establish the JMX connection to the JBoss server. See Enable remote management through JMX for information.

  1. Install the latest version of the Splunk Add-on for JMX on the Splunk Enterprise instance responsible for JMX data collection, usually a heavy forwarder. This add-on can collect JMX metrics locally or remotely.

  2. Copy the following JBoss .jar files to the Splunk Add-on for JMX bin/lib folder:

  • jboss-cli-client.jar
  • jbossws-api-1.0.1.Final.jar

  • jbossws-common-2.1.0.Final.jar

    Note

    If you are using version 3.1.0 of the Splunk Add-on for JMX you do not need to copy these .jar files as the files are already included.

    a. Go to your JBoss installation directory and navigate to $JBOSS_HOME/bin/client/jboss-cli-client.jar.

    b. Copy the jboss-cli-client.jar file to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib.

    c. Download the jbossws-api-1.0.1.Final.jar and jbossws-common-2.1.0.Final.jar files from the MVN repository at http://mvnrepository.com/artifact/org.jboss.ws/jbossws-api/1.0.1.Final and http://mvnrepository.com/artifact/org.jboss.ws/jbossws-common/2.1.0.Final, respectively.

    d. Copy the jbossws-api-1.0.1.Final.jar and jbossws-common-2.1.0.Final.jar files to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib.

  1. After copying, verify the files successfully copied to your $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory before continuing.

  2. Restart the add-on.

  3. Go to Splunk Web and access the configuration pages for the Splunk Add-on for JMX, either by clicking Splunk Add-on for JMX in the left nav, or going to Apps > Manage Apps, then clicking Launch app in the row for Splunk Add-on for JMX.

  4. Click Add to add a new JMX server.

  5. Enter a Name and an optional JVM Description for your JBoss server.

  6. For Connection Type, select one of the following from the dropdown menu:

    • Use URL directly - Example:

    service:jmx:remoting-jmx://<IP_Address>:9999 (JBoss EAP 6.x server)

    service:jmx:remote+http://<IP_Address>:9990 (JBoss EAP 7.x server)

    The JBoss server can be local (installed on the same server as the Splunk Add-on for JMX) or remote.

    • Customized script

    The JBoss server must be installed on the same server as the Splunk Add-on for JMX.

    • Process id

    The JBoss server must be installed on the same server as the Splunk Add-on for JMX.

    • Process file

    The JBoss server must be installed on the same server as the Splunk Add-on for JMX.

  7. Click Add.

  8. Navigate to the input configurations by clicking Configurations > Inputs.

  9. Click Create New Input to create a new JMX input.

  10. Enter a Name and optional Description for your input, then select the server that you just configured in the Servers tab.

  11. On the Templates tab, select one or more of the predefined templates for JBoss to collect the data that you want.

  12. Enter jboss:jmx in the Source Type text box.

  13. Click Add to enable your JMX input.

  14. Validate that data is coming in by searching for:

    Search

    sourcetype=jboss:jmx

For more information about configuring JMX inputs, refer to Configure the inputs for the Splunk Add-on for JMX in the Splunk Add-on for Java Management Extensions manual.

Ended: Configuration

Troubleshooting ↵

Troubleshoot the Splunk Add-on for JBoss

General troubleshooting

For helpful troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Splunk restarts after installing or upgrading the Add-on when the JMX addon is not installed

The JBoss Add-on will trigger a Splunk restart in case the Splunk Add-on for JMX is not installed on the same Splunk instance. The jmx_templates.conf file present in JBoss Add-on will trigger the restart if the Splunk Add-on for JMX is not installed. Install it to avoid a restart.

Splunk Add-on for JBoss logs

This add-on has 4 logs that are located at $SPLUNK_HOME/var/log/splunk:

  • splunk_ta_jboss_main.log
  • splunk_ta_jboss_setup.log
  • splunk_ta_jboss_util.log
  • splunk_ta_jboss_account_validation.log

To check for errors in the internal logs for this add-on, you can perform this search:

Search

index=_internal source=*ta_jboss*

You can configure the logging verbosity on the Logging page for the add-on. Supported log levels are INFO, DEBUG, and ERROR.

Splunk Add-on for JMX logs

To check for JMX errors, you can perform this search of the Splunk Add-on for JMX internal logs:

Search

index=_internal source=*jmx*

Ended: Troubleshooting

Reference ↵

Common Information Model and Field Mapping Changes for the Splunk Add-on for JBoss

Version 3.0.0 of the Splunk Add-on for JBoss introduced Common Information Model (CIM) and field mapping changes to its sourcetypes. See the following sections for information on changes to the mapping.

Note

There are no CIM model or Field Mapping changes for jboss:jmx and jboss:gc:log sourcetype.

CIM model and Field Mapping changes for Jboss:server:log

See the following comparison tables for CIM model and field mapping changes for the jboss:server:log sourcetype.

CIM model comparison for versions 2.1.0 and 3.0.0

Sourcetype message_id Previous CIM model New CIM model
jboss:server:log OPVDX001, WFLYSRV0055, WFLYSRV0056 Alerts

​​Field mapping comparison for versions 2.1.0 and 3.0.0

Source-type message_id, thread_name Fields added Fields removed
jboss:server:log WFLYSRV0056, WFLYSRV0055, Controller Boot Thread tag::eventtype, tag

CIM model and Field Mapping changes for Jboss:access:log

See the following comparison tables for CIM model and field mapping changes for the jboss:access:log sourcetype.

CIM model comparison for versions 2.1.0 and 3.0.0

Sourcetype Previous CIM model New CIM model
jboss:access:log Web

​​Field mapping comparison for versions 2.1.0 and 3.0.0

Source-type Fields added Fields removed
jboss:access:log dest, tag, src_ip, dest_port, bytes_out, vendor_product, category, eventtype, http_user_agent_length, bytes, tag::eventtype, src, url_domain, bytes_in, http_referrer_domain, action

Lookups for the Splunk Add-on for JBoss

The Splunk Add-on for JBoss has one lookup. The lookup file map fields from JBoss EAP server logs to CIM-compliant values in the Splunk platform. The lookup file is located in $SPLUNK_HOME/etc/apps/Splunk_TA_jboss/lookups.

Filename Description
jboss_severity_type.csv Maps log_level to severity,type
jboss_http_status.csv Maps the action field to a status_description value for individual status code.

Source types for the Splunk Add-on for JBoss

The Splunk Add-on for JBoss supports the following data sources using the following collection methods and provides the following source types and CIM mappings.

Data source Collection method source type CIM data models
Thread information from JMX MBean operations Modular input (dumpAllThreads) jboss:jmx JVM
Performance metrics from JMX MBean attributes Splunk Add-on for JMX jboss:jmx JVM
Server log (server.log) File monitoring jboss:server:log Alerts, Change
Garbage collection log (gc.log ) File monitoring jboss:gc:log n/a
Access log (access.log ) File monitoring jboss:access:log Web

Ended: Reference