Red Hat / CentOS / Fedora – Splunk – PERL – Apache Server Status

Guide Followed: https://community.splunk.com/t5/Getting-Data-In/Reading-Apache-server-status-output/m-p/48158

First make sure your Apache server-status is setup (assuming you already have Apache/httpd installed)

# Create apache_exporter user
sudo useradd apache_exporter -s /sbin/nologin
 
# Create Apache Location
declare apache_exporter=$(cat <<EOF
ExtendedStatus on
<Location /server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Location>
EOF
)
echo "$apache_exporter"
echo -e "$apache_exporter"|sudo tee /etc/httpd/conf.d/server-status.conf
 
# Restart Apache
sudo systemctl restart httpd
 
# Validate Page
curl http://127.0.0.1/server-status

# Validate Scrape-Able Page
curl http://127.0.0.1/server-status?auto

PERL script for scraping the data for SPLUNK

#!/usr/bin/perl

###
#Simple script to parse Apache Server statistics for Splunk
###

use LWP::UserAgent;

# @apache_urls=("http://server1/server-status","http://server2/server-status");
# @apache_urls=("http://127.0.0.1/server-status");
@apache_urls = $ARGV[0];

foreach $url (@apache_urls) {
        my $ua = new LWP::UserAgent;
        $ua->agent('Splunk Apache Statistics Script');
        my $request = HTTP::Request->new('GET');
        $request->url($url);
        my $response = $ua->request($request);
        my $body = $response->content;

        ### Extract stats
        $body=~ m/Apache Server Status for ([^>]+)<\/h1>/;
        $server_name=$1;
        $body=~ m/Current Time: [^,]+, ([^<]+)<\/dt>/;
        $timestamp=$1;
        # $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) (k*B)\/second - ([^\s]+) (k*B)\/request<\/dt>/;
        $body=~ m/<dt>([^\s]+) requests\/sec - ([^\s]+) (k*B)\/second - ([^\s]+) ([k,M]*B)\/request<\/dt>/; 
        $request_stats="requests_per_second=$1,$3_per_second=$2,$5_per_request=$4";
        $body=~ m/<dt>([^\s]+) requests currently being processed, ([^\s]+) idle workers<\/dt>/;
        $processing_stats="requests_currently_being_processed=$1,idle_workers=$2";
        $body=~ m/<dt>CPU Usage: u([^\s]+) s([^\s]+) cu.* cs.* - ([^\s]+%) CPU load<\/dt>/;
        $cpu_stats="user_cpu=$1,system_cpu=$2,cpu_load=$3";
        print "$timestamp,ServerName=$server_name,$request_stats,$processing_stats,$cpu_stats \n";
}

Example:

perl Splunk-Apache_Server-Status.pl "http://127.0.0.1/server-status"
02-Apr-2021 08:56:36 EDT,ServerName=127.0.0.1 (via 127.0.0.1),requests_per_second=02-Apr-2021 08:56:36 EDT,_per_second=,_per_request=,requests_currently_being_processed=1,idle_workers=74,user_cpu=.22,system_cpu=.45,cpu_load=.0333%