Outcold Solutions is sponsoring Splunk .conf26 - see you there!

# Monitoring Windows Containers

## Installation

This guide walks you through installing Monitoring Windows Containers end-to-end: configuring the Splunk app and HTTP Event Collector, then deploying Collectord on your Windows hosts to forward metadata-enriched container logs, host logs, and metrics. A typical install takes under 10 minutes. If you don’t have a license yet, you can [request a 30-day evaluation](/content/trial/request/index.html).

Features:

- Log collection on top of the native JSON logging driver - no driver swap required.
- Tiny image, tiny binary. Low memory, CPU, and disk footprint.
- Logs enriched with Docker metadata (container, image, labels).
- Container metrics alongside logs, so you can correlate the two.
- Process metrics.
- Docker service log forwarding.
- HTTP Event Collector for ingest into Splunk. Requires Splunk 6.5 or above - talk to us if you need support for an earlier version.
- Multi-line event support.
- At-least-once delivery guarantee.

## Splunk configuration

### Install the Monitoring Windows Containers application

Install [Monitoring Windows Containers](https://splunkbase.splunk.com/app/3858/) from Splunkbase on your Search Heads only.

### Enable HTTP Event Collector in Splunk

Collectord forwards data to Splunk over the [HTTP Event Collector](https://dev.splunk.com/view/event-collector/SP-CAAAE6M) (HEC). HEC is off by default - read the [HTTP Event Collector walkthrough](https://dev.splunk.com/view/event-collector/SP-CAAAE7F) to enable it.

Once HEC is enabled, you need two pieces of information for the rest of this guide: the HEC endpoint URL and an HEC token. If your Splunk instance is on `hec.example.com` listening on port `8088` over SSL, with a token of `B5A79AAD-D822-46CC-80D1-819F80D7BFB0`, you can verify both with `curl`:

```bash
curl -k https://hec.example.com:8088/services/collector/event/1.0 -H "Authorization: Splunk B5A79AAD-D822-46CC-80D1-819F80D7BFB0" -d '{"event": "hello world"}'
{"text": "Success", "code": 0}
```

> `-k` skips certificate validation; use it only for self-signed certificates.

## Install Collectord for Windows Containers

Use the latest available Collectord for Windows Containers distribution.

Open PowerShell as _Administrator_, then download Collectord and extract the archive:

```batch
cd ~\Downloads
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri https://www.outcoldsolutions.com/docs/monitoring-wincontainers/monitoring-wincontainers.zip -OutFile monitoring-wincontainers.zip
Expand-Archive .\monitoring-wincontainers.zip -DestinationPath .\monitoring-wincontainers\
```

Create a folder for Collectord:

```batch
mkdir C:\collector\
```

Copy `collector.exe` and `collector.conf` into it:

```batch
cp .\monitoring-wincontainers\collector\collector.exe c:\collector\
cp .\monitoring-wincontainers\collector\collector.conf c:\collector\
```

Create a folder for Collectord’s database - it stores file metadata and read positions there:

```batch
mkdir C:\collector\data
```

Open `collector.conf` in your editor of choice to set the Splunk HEC URL and token:

```batch
notepad C:\collector\collector.conf
```

Find the Splunk output stanza:

```ini
[general]

; license =

# Splunk output
[output.splunk]

# Splunk HTTP Event Collector url
; url =

# Splunk HTTP Event Collector Token
; token =

# Allow invalid SSL server certificate
; insecure = false
```

Uncomment the required parameters, fill in the HEC URL, token, and `insecure` if needed, and paste in your license key (request an evaluation key with [this automated form](/content/trial/request/index.html)):

```ini
[general]

license = ...

# Splunk output
[output.splunk]

# Splunk HTTP Event Collector url
url = https://hec.example.com:8088/services/collector/event/1.0

# Splunk HTTP Event Collector Token
token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0

# Allow invalid SSL server certificate
insecure = true
```

> If Splunk uses a self-signed certificate, you’ll want a few SSL-specific settings. The quickest way to get going is `insecure = true` to skip SSL validation, as shown above.

> Collectord doesn’t require you to change Docker’s default logging driver - it reads from the default JSON logging driver in place.

> If Docker is installed somewhere other than the `C:` drive, find every default config that references `C:`, uncomment those values, and point them at the correct drive.

Open `cmd.exe` or PowerShell as **Administrator**, switch to `C:\collector`, and run Collectord in the foreground to verify forwarding works:

```batch
.\collector.exe monitor --environment=wincontainers --conf=C:\collector\collector.conf
```

You should see Collectord output on the console and, within a few moments, data flowing into Splunk. Once that looks right, stop it and install it as a Windows Service:

```batch
New-Service -Name collectorforwincontainers -BinaryPathName 'C:\collector\collector.exe winservice --environment=wincontainers --conf=C:\collector\collector.conf' -DisplayName "Collector for Windows Containers" -StartupType 'Automatic' -DependsOn 'docker'
```

Press enter to accept `LocalSystem` for the service account, then start the service:

```batch
Start-Service collectorforwincontainers
```

## Docker configuration

By default, Docker doesn’t rotate JSON log files - they grow until they fill the disk. Pass `--log-driver=json-file --log-opt=max-size=100m --log-opt=max-file=5` to the Docker daemon to cap them. See [Configure and troubleshoot the Docker daemon](https://docs.docker.com/engine/admin/) for details.

## Screencasts

### Solution Overview

Monitoring Windows Containers v2.1. Overview (Splunk Application) - YouTube

[Monitoring Windows Containers v2.1. Overview (Splunk Application)](https://www.youtube.com/watch?v=wMKytIkqeME) [Outcold Solutions](https://www.youtube.com/channel/UC9aSraRYj3SJLzJWziJyU8g)

## Release History

### 2.1 - 2018-01-15

> Requires collectorfordocker version 2.1.66.180115 or above

- Initial release with log forwarding, containers and processes metrics.

## What is next?

- [Collectord for Windows Containers deep dive and advanced configurations](/content/docs/monitoring-wincontainers/collectorforwincontainers/index.html)
- [FAQ and the common questions](/content/docs/faq/index.html)
- [License agreement](/content/legal/license-agreement/index.html)
- [Pricing](/content/pricing/index.html)
- [Contact](/content/contact/index.html)