# Collectd Notes.md

Collectd is used to tracking hard drive space and cpu usage. The data is collectd on the servers and sent to the Moose indexers via HEC. 

# Service

systemctl restart collectd

## How do i search the data in Splunk?
05/08/2020

| mstats count WHERE index=collectd metric_name=* by host, metric_name

## Junk in syslog

Currently a bug in collectd where it writes the response from HEC into
the system log `/var/log/messages`.  There's a github issue, 
https://github.com/collectd/collectd/issues/3105.  Duane has a PR in to fix it, in theory - https://github.com/collectd/collectd/pull/3263

Duane's PR has been merged.