Nagios Core vs Splunk Enterprise

Nagios monitoring is well suited for any mission critical application that requires per/second (or minute) monitoring. This would probably include even a shuttle launch. As Nagios was built around Linux, most (85%) plugins are Linux based, therefore its more suitable for a Linux environment.

As Nagios (and dependent components) requires complex configurations & compilations, an experienced Linux engineer would be needed to install all relevant components.

Any company that has hundreds (or thousands) of servers & services to monitor would require a stable monitoring solution like Nagios. I have seen Nagios used in extremely mediocre ways, but the core power lies when its fully configured with all remaining open-source components (i.e. MySQL, Grafana, NRDP etc). Nagios in the hands of an experienced Linux engineer can transform the organizations monitoring by taking preventative measures before a disaster strikes.

Pros: Splunk is very well suited if you have multiple log sources of related data. All of them can be correlated and tasks can be automated based on the requirement. Other than alerts, Splunk can also run a specific script of your choice, based on some defined conditions. Cons: If you have a few logs but a large number of log sources, Splunk can be very expensive.

• Monitoring of services is one of the biggest benefits for our company. Being able to respond in a timely fashion keeps business smooth.
• Hardware and device monitoring are easy to set up with proper parameters.
• Notification to key staff to be able to respond quickly makes issues go away faster.

• Real-time + Scheduled alerts - i-e you can set up alerts which are actively monitoring your logs
• Pretty good response time for search results. With our key/value logging, Splunk makes it blazing fast to query the data.
• Dashboards provide insights into historical data
• Love how Splunk indexes all of the data and provides keys to search on

• Nagios could use core improvements in HA, though, Nagios itself recommends monitoring itself with just another Nagios installation, which has worked fine for us. Given its stability, and this work-around, a minor need.
• Nagios could also use improvements, feature wise, to the web gui. There is a lot in Nagios XI which I felt were almost excluded intentionally from the core project. Given the core functionality, a minor need. We have moved admin facing alerts to appear as though they originate from a different service to make interacting with alerts more practical.

• At times some queries can run slowly if indices are not on a portion of the query you use.
• Setup time initially can be difficult if your logs aren't stored in common locations or in a common way to write the log.
• Ability to ingest logs from different locations without having to change code to put logs in a certain place (pro and con).
• Searches can be a bit more difficult to look through if your log isn't pulled in a manner that is easy to read through splunk.

We're currently looking to combine a bunch of our network montioring solutions into a single platform. Running multiple unique solutions for monitoring, data collection, compliance reporting etc has become a lot to manage.

We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.

The Nagios UI is in need of a complete overhaul. Nice graphics and trendy fonts are easy on the eyes, but the menu system is dated, the lack of built in graphing support is confusing, and the learning curve for a new user is too steep.

You can literally throw in a single word into Splunk and it will pull back all instances of that word across all of your logs for the time span you select (provided you have permission to see that data). We have several users who have taken a few of the free courses from Splunk that are able to pull data out of it everyday with little help at all.

When properly setup and configured, Splunk is extremely reliable.

I haven't had to use support very often, but when I have, it has been effective in helping to accomplish our goals. Since Nagios has been very popular for a long time, there is also a very large user base from which to learn from and help you get your questions answered.

Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method.

Smooth without too many major issues.

Because we get all we required in Nagios [Core] and for npm, we have to do lots of configuration as it is not as easy as Comair to Nagios [Core]. On npm UI, there is lots of data, so we are not able to track exact data for analysis, which is why we use Nagios [Core].

I wanted to learn a new language that I can quickly master and implement. Splunk is easy, fun to use and best of all, it can be developed in hours not days or weeks. Splunk is fundamentally a programming language that is minimal but yet powerful enough to collect, analyze and visualize data.

Splunk can scale in to the petabyte per day range which of course is awesome

• With it being a free tool, there is no cost associated with it, so it's very valuable to an organization to get something that is so great and widely used for free.
• You can set up as many alerts as you want without incurring any fees.

• Overall very positive. It has provided visibility to what is going on within our network.
• One drawback is the time it takes to get up to speed with the application, but this is up to the user, and Splunk education is excellent.
• In my field, IT Security, there are few other friends to have in your back pocket better than Splunk. They are just that good.