Monitoring macOS
Forward Mac metrics, logs and events to Splunk.
Install one package on each Apple Silicon Mac - by hand, with Homebrew or through your MDM - and forward its hardware, process and power stats to a Splunk metrics index, and the unified log, crash reports, launchd services, logins and security settings to an events index. Dashboards for CI and build fleets, virtual machine hosts and the laptops IT looks after, and an Alert Catalog to pick your alerts from.
Installation
Set up Splunk, the HEC token, and install Collectord on each Mac
→Dashboards
A tour of the app's dashboards
→Configuration
Config files, managed preferences, and the shipped defaults
→Metrics index
Every stat goes to a Splunk metrics index
→Log forwarding
Unified log packs, crash reports, the install log and your own files
→Splunk HTTP Event Collector
Configure SSL and connection settings for Splunk HEC
→Alert Catalog
Pick, scope and create alerts from templates
→Common Information Model
Map Macs to CIM data models for Splunk Enterprise Security
→Privacy
What it collects, what it does not, and the switch for each
→Troubleshooting
Run verify, read the logs, and diagnose common issues
→Release history
Changelog of Collectord and Splunk app releases
→