# Collectd Notes.md

`Collectd` is used to tracking hard drive space and cpu usage. The data is collectd on the servers and sent to the Moose indexers via HEC. 

# Service

`systemctl restart collectd`

## How do i search the data in Splunk?
05/08/2020

| mstats count WHERE index=collectd metric_name=* by host, metric_name

## Junk in syslog

Currently a bug in collectd where it writes the response from HEC into
the system log `/var/log/messages`.  There's a github issue, [Collectd Issue 3105](https://github.com/collectd/collectd/issues/3105).  Duane has a PR in to fix it, in theory - [PR 3263](https://github.com/collectd/collectd/pull/3263)

Duane's PR has been merged.