Reading Apache server-status output

Question

Has anyone tried to have splunk parse the output of the machine readable apache server-status page, e.g http://$apachehost/server-status?auto

I need to keep track of the status of workers, whether they are waiting, logging, etc.

Thanks

Answer 1

I use a scripted input - I wrote a perl script to make a call to the Apache servers to pull stats..

I'll include the code below to get you started:

#!/usr/bin/perl

###
#Simple script to parse Apache Server statistics for Splunk
###

use LWP::UserAgent;

@apache_urls=("http://server1/server-status","http://server2/server-status","http://server3/server-status","http://server4/server-status");

foreach $url (@apache_urls) {
        my $ua = new LWP::UserAgent;
        $ua->agent('Splunk Apache Statistics Script');
        my $request = HTTP::Request->new('GET');
        $request->url($url);
        my $response = $ua->request($request);
        my $body = $response->content;

        ### Extract stats
        $body=~ m/Apache Server Status for ([^>]+)<\/h1>/;
        $server_name=$1;
        $body=~ m/Current Time: [^,]+, ([^<]+)<\/dt>/;
        $timestamp=$1;
        $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) kB\/second - ([^\s]+) kB\/request<\/dt>/;
        $request_stats="requests_per_second=$1,kB_per_second=$2,kB_per_request=$3";
        $body=~ m/<dt> ([^\s]+) requests currently being processed, ([^\s]+) idle workers<\/dt>/;
        $processing_stats="requests_currently_being_processed=$1,idle_workers=$2";
        print "$timestamp,ServerName=$server_name,$request_stats,$processing_stats \n";
}

Answer 2

Hi,

I fixed a few typos and extended the script to work on lower-traffic servers and to provide CPU usage:

#!/usr/bin/perl

###
#Simple script to parse Apache Server statistics for Splunk
###

use LWP::UserAgent;

@apache_urls=("http://server1/server-status","http://server2/server-status");

foreach $url (@apache_urls) {
        my $ua = new LWP::UserAgent;
        $ua->agent('Splunk Apache Statistics Script');
        my $request = HTTP::Request->new('GET');
        $request->url($url);
        my $response = $ua->request($request);
        my $body = $response->content;

        ### Extract stats
        $body=~ m/Apache Server Status for ([^>]+)<\\/h1>/;
        $server_name=$1;
        $body=~ m/Current Time: [^,]+, ([^<]+)<\\/dt>/;
        $timestamp=$1;
        $body=~ m/<dt>([^\\s]+) requests\\/sec - ([^\\s]+) (k*B)\\/second - ([^\\s]+) (k*B)\\/request<\\/dt>/;
        $request_stats="requests_per_second=$1,$3_per_second=$2,$5_per_request=$4";
        $body=~ m/<dt>([^\\s]+) requests currently being processed, ([^\\s]+) idle workers<\\/dt>/;
        $processing_stats="requests_currently_being_processed=$1,idle_workers=$2";
        $body=~ m/<dt>CPU Usage: u([^\\s]+) s([^\\s]+) cu.* cs.* - ([^\\s]+%) CPU load<\\/dt>/;
        $cpu_stats="user_cpu=$1,system_cpu=$2,cpu_load=$3";
        print "$timestamp,ServerName=$server_name,$request_stats,$processing_stats,$cpu_stats \\n";
}

Reading Apache server-status output

Follow this question

Splunk Resources

Related questions