Outcold Solutions is sponsoring Splunk .conf26 - see you there!

Monitoring Linux

# Installation

This guide walks you through installing Monitoring Linux end-to-end: configuring the Splunk app and HTTP Event Collector, then installing Collectord on your Linux host as a systemd service to forward host logs (syslog, journald), host metrics, and process metrics. A typical install takes under 10 minutes. If you don’t have a license yet, you can [request a 30-day evaluation](/content/trial/request/index.html).

### Install the Monitoring Linux application

Install [Monitoring Linux](https://splunkbase.splunk.com/app/4768/) from Splunkbase on your Search Heads only.

If you’re using a dedicated index that isn’t searchable by default, update the `macro_linux_base` macro to include it:

```text
macro_linux_base = (index=linux)
```

### Enable HTTP Event Collector in Splunk

Collectord forwards data to Splunk over the [HTTP Event Collector](https://dev.splunk.com/view/event-collector/SP-CAAAE6M) (HEC). If HEC isn’t enabled yet, follow Splunk’s [HTTP Event Collector walkthrough](https://dev.splunk.com/view/event-collector/SP-CAAAE7F).

> The minimum requirement is Splunk Enterprise or Splunk Cloud 6.5. If you’re managing Splunk Clusters older than 6.5, see our [FAQ on setting up a Heavy Weight Forwarder in between](/content/docs/faq/index.html).

Once HEC is enabled, you need two pieces of information for the rest of this guide: the HEC endpoint URL and an HEC token. You can verify both with `curl`:

```bash
$ curl -k https://hec.example.com:8088/services/collector/event/1.0 -H "Authorization: Splunk B5A79AAD-D822-46CC-80D1-819F80D7BFB0" -d '{"event": "hello world"}'
{"text": "Success", "code": 0}
```

> `-k` skips certificate validation; use it only for self-signed certificates.

> Splunk Cloud uses a different HEC URL than Splunk Web - see [Send data to HTTP Event Collector on Splunk Cloud instances](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector_on_Splunk_Cloud_instances).

## Install Collectord for Linux

Download [collectorforlinux.tar.gz](/content/docs/monitoring-linux/builds/5.21.410/collectorforlinux.tar.gz) and extract it into `/opt/collectorforlinux`. The archive contains builds for both `amd64` and `aarch64` architectures.

```bash
sudo curl -O /docs/monitoring-linux/builds/5.21.410/collectorforlinux.tar.gz -o /tmp/collectorforlinux.tar.gz
sudo mkdir -p /opt/collectorforlinux
sudo tar -xvf /tmp/collectorforlinux.tar.gz -C /opt/collectorforlinux
```

Open `/opt/collectorforlinux/etc/002-user.conf` with your editor:

```bash
sudo edit /opt/collectorforlinux/etc/002-user.conf
```

This file holds your overrides for the Collectord defaults. The full default configuration lives in `/opt/collectorforlinux/etc/002-general.conf` - refer to it when you need to know what options exist.

In `002-user.conf`, set the Splunk HEC URL and token, [review and accept the license agreement](/content/legal/license-agreement/index.html), and paste in your license key (request an evaluation key with [this automated form](/content/trial/request/index.html)). Naming the cluster is optional but useful when you’re monitoring more than one host group and want to filter by cluster in the app.

```ini
[general]
acceptLicense = true
license = ...
fields.linux_cluster = dev

[output.splunk]
url = https://hec.example.com:8088/services/collector/event/1.0
token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0
insecure = true
```

You can run collectorforlinux directly from the terminal to confirm the configuration is valid:

```text
sudo /opt/collectorforlinux/bin/collectorforlinux
```

### Install the collectorforlinux service with systemd

The package ships a systemd unit you can link with `systemctl` and run as a background daemon:

```bash
sudo systemctl link /opt/collectorforlinux/bin/collectorforlinux.service
sudo systemctl daemon-reload
sudo systemctl enable collectorforlinux
sudo systemctl start collectorforlinux
```

Tail the logs to confirm Collectord is running:

```bash
sudo journalctl -fu collectorforlinux
```

## Next steps

- Review the predefined [alerts](/content/docs/monitoring-linux/alerts/index.html) and enable the ones relevant to your environment.
- If something looks off, work through the [troubleshooting](/content/docs/monitoring-linux/troubleshooting/index.html) checks.
- Configure log [forwarding](/content/docs/monitoring-linux/forwarding/index.html) from custom locations beyond `/var/log` and journald.