The OSS Quorum App for Splunk contains a set of dashboards and analytics to give you full visibility into the system metrics, application data, and ledger so that you can maintain security, stability, and performance for your ConsenSys Quorum deployment. This application is an open source blockchain project.
These free blockchain dashboards are meant to be a starting point for building analytics around your Quorum blockchain no matter where it is deployed.
The app provides you with several dashboards to get you started with analyzing your Quorum deployment. These include:
- Data Setup - A dashboard that shows what data is received by Splunk.
- Raw Data Flow - A dashboard that shows the data flowing in from each Quorum node and data source.
- Infrastructure Health and Monitoring - An overview of system health from system metrics like CPU, uptime status, and transaction latency. You can see in real time when transactions are starting to back up or a node is falling behind on blocks.
- Transaction Analytics - A cryptocurrency dashboard with real-time visibility into the transactions being written to the ledger. You can see a breakdown of private versus public transactions and analytics around addresses.
- Ledger Query - Query the ledger to consult event and cryptocurrency data.
You can configure three different types of data sources to use all of the dashboards. Not all of these data sources are required to use the app.
- Quorum Blocks, Transactions, and Events - These logs contain transaction information from the ledger itself and provide insight into operations and actions on-chain. We’ve open sourced Splunk Connect for Ethereum to help you easily ingest Quorum ledgers in Splunk.
- Quorum node logs and metrics - These are logs and metrics specific to a Quorum node. Specifically, Quorum application logs, Prometheus metrics, and RPC data polled from different Quorum node endpoints (for example, admin_peers, txpool_content, etc.) See Splunk Connect for Ethereum for more information.
- Infrastructure/System Level Metrics and Logs - System metrics such as CPU, MEM, DISK, and NETWORK activity provide insight into the underlying infrastructure that Quorum nodes are running on. These metrics/logs could come from Docker, Kubernetes, IBM IKS, Microsoft Azure, Google’s GCP, and AWS Cloudwatch, to name a few. Splunk has different add-ons and connectors for each.
- Install the App on a Splunk Enterprise Search Head that will have access to the data.
- Open the App and navigate to the Data Setup dashboard from the Introduction Page.
- Follow the instructions for each of the 3 data sources on the Data Setup page in order to populate the graphs and validate that data is coming in correctly.
- Quorum Block and Transaction Data - Splunk Connect for Ethereum is an open source agent that connects to each node on the Quorum network. See its Readme for deployment instructions. Docker, Kubernetes, and native deployments are all options.
- Quorum node logs and metrics - You need to create event and metric indexes in Splunk, as well as an input mechanism to receive the data. It's recommended to create indexes called “ethereum” and “metrics” and enable the Splunk HEC to receive data. You can use the example
indexes.conf.exampleprovided in the app. Rename the file from
indexes.confto enable the indexes, and rename
inputs.confto enable the HEC endpoints. You also need to enable the HTTP Event Collector (HEC) to receive data if it has not been enabled already.
$ cd $SPLUNK_HOME/etc/apps/splunk-app-quorum/default $ sudo mv inputs.conf.example inputs.conf $ sudo mv indexes.conf.example indexes.conf $ cd /opt/splunk/bin $ sudo ./splunk restart
- Quorum node JSON-RPC data - Quorum nodes also have RPC endpoints that Splunk Connect for Ethereum can poll and send to Splunk. This can be used to monitor transaction pool activity on a node, active peers, or leader election in Raft or Istanbul. In order for this to work, the required endpoints need to be allow listed on the Quorum node. See the Readme at Splunk Connect for Ethereum for more information.
You can combine node monitoring with additional Splunk solutions to monitor the environment and infrastructure. Here is a non-exhaustive lists of applications you can combine with our offerings:
- Docker: Splunk Docker Logging Driver
- Kubernetes: Splunk Connect for Kubernetes
- Syslog: Monitoring Network Ports in Splunk
- Log File: Monitoring Files and Directories with Splunk
- IBM Cloud Platform: IBM Cloud Platform
- Microsoft Azure: Splunk Add-on for Microsoft Cloud Services
- AWS Cloudwatch: Splunk App for AWS
- GCP Stackdriver: Splunk Add-on for Google Cloud