Best Practice for Role Configuration

[Guest]

I have a network with both linux and windows boxes. I have several monitors that I deploy to each of these systems. I am using otter to check that the monitors are configured correctly.

I am currently monitoring a splunkforwarder and a nagios agent. I have 1 role that just handles splunk on windows and 1 that handles nagios on windows. I was going to make one to handle splunk on linux and 1 to handle nagios on linux. These would make sure the system points to the variables in the Environment, and each machine would have 2 roles.

Is this considered a best practice, or would it be better to have one role for splunk that handles both linux and windows... or better to bundle both agent into a single role?

I have been assuming that the smaller roles would be easier to maintain and debug as well as easier to add a new role rather than incrementally modify an existing larger role.

[Guest]

Good question; I'm not familiar enough w/ splunk to give a definite answer, but I would assume:

• the Windows agent and the Linux agent are different binaries
• the configuration is non-trivial (i.e. more than a couple operations)
• there is effectively no shared configuration/operations in the plans
• there is minimal shared configuration (ApiKey or AcocuntNumber)

Based on that, I would probably do two separate roles, splunk-linux and splunk-windows or something like that.

Of course, if there was mostly shared configuration, or if only a few operations were operating-system dependent (be it Linux or Windows 2003 vs 2008), then having an if/else sort of thing seems fine.

One major benefit of the roles here will be, someone looks at it from the dashboard and says "oh ok, Splunk is installed". It's already obvious that it's a Linux vs Windows server.

And to me, the ApiKey/AccountNumber/whatever seem like variables on the role (or maybe environment, if it's different in Prod and Integration).

Down the line, we'll probably have something to deal with nested roles, role dependencies, those sorts of thing. Really need to see what the data in the field looks like!