Splunk forwarding and receving

1) Install Splunk server
2) Install Splunk on host machines you want to monitor. Please have splunk forwarder license on the host.
3) Setup Splunk server as a receiver and the splunk on other target systems as forwarder

4) Setup Receiver
Navigate to Manager > Forwarding and Receiving > Receive data > Configure receiving > New
Set up port as 8090 or any available  port
Restart splunk

5) Setup Forwarder
Navigate to Manager > Forwarding and Receiving > Forward data > Configure forwarding > New
Provide {splunk_server_ip_from_step4):8090
Restart splunk

Note: If you are copying splunk install from one machine another, please do this step
Login to Splunk
Navigate to Manager > System settings > General settings
Splunk server name and Default host name should match the host name
Save and restart.

JON LDAP integration

JON integration with Active Directory LDAP
1) Login into JON
2) Navigate to Administration > System Configuration > Settings
3) In the LDAP configuration Properties, update the following parameters
 Check the flag use LDAP Authentication
 URL: ldap://{active_directory_server_name}
 Username:{specify your bind id using complete dn}
 Search Base:{specify base dn}
 Login Property: sAMAccountName
 Click ok
4) Login into JON database (Oracle)
 Execute the query: select * from RHQ_SYSTEM_CONFIG
 Notice the property key for CAM_LDAP_BIND_PW has the default password. Update the password of Active Directory Bind Account.
SQL> update RHQ_SYSTEM_CONFIG set property_value='password' where property_key='CAM_LDAP_BIND_PW';
SQL> commit;
5) Restart JON
6) Login to JON admin as user default: rhqadmin
7) Create desired roles using Administration > Security > Roles.
8) Login using AD account and logout
9) Login using rhqadmin and assign AD user to the desired roles.
10) Login again using  AD account and perform operations

Splunk installation and LDAP integration

The installation steps are for RHEL 5 64 bit

1) Create user

#useradd -m splunkadm

#passwd splunkadm

Login an splunkadm

2) Install Splunk

Download splunk-4.1.3-80534-Linux-x86_64.tgz from splunk.com

Copy to /opt or install folder

#tar -xvf splunk-4.1.3-80534-Linux-x86_64.tgz

The contents will be extracted to /opt/splunk

3) Start Splunk

/opt/splunk/bin/splunk start

Launch the web console http://{ip_address}:8000

Login using user admin and password changeme

4) Check status

/opt/splunk/bin/splunk status

5) Import License

Navigate to Manager -> License. Paste your license.

Restart Splunk

/opt/splunk/bin/splunk restart

6) Email Settings

Navigate to Manager > System settings > Email alert settings

Set appropriate parameters. PDF report option can be selected.

7) Setup Authentication
a) Navigate to Manager > Access controls > Authentication method
Set appropriate parameters.
For Active Directory
Host: {your_ad_host}
Port: 389
Bind DN: {your_bind_user_id}
Bind DN Password: {your_bind_user_id_password}
User Base DN: {as appropriate}
User base filter: {Leave empty: set it later}

User name attribute: samaccountname
Real name attribute: cn
Group mapping attribute: dn
Group base DN: {as appropriate}
Group name attribute: cn
Group member attribute: member
Save

b) You should see a new link Configure LDAP role mapping
If you see any errors, correct the LDAP settings.
Click on the Configure LDAP role mapping link.
Select a group and asssign the desired roles.

JBOSS Clustering and Buddy Replication

1) Enable the buddy replication in JBOSS in
$JBOSS_SERVER_HOME/deploy/cluster/jboss-cache-manager.sar/META-INF/jboss-cache-manager-jboss-beans.xml

<property name="buddyReplicationConfig">
<bean class="org.jboss.cache.config.BuddyReplicationConfig">
<!--  Just set to true to turn on buddy replication -->
<property name="enabled">true</property>

2) In order for the HTTP session replication to work, make sure the application is distributable.

Please add this tag <distributable/> in WEB-INF/web.xml
 <distributable/>
</web-app>

Multicast addressing in JBOSS

Reference:
http://www.cisco.com/en/US/tech/tk828/technologies_white_paper09186a00802d4643.shtml