Skip to content
Sondar

Getting started

Getting started

Section titled “Getting started”

From a fresh install to your first alert, in six steps. Each step has a fuller page; this is the path through them.

If you are new to the data model, skim Concepts first — it is short and every page assumes it.

1. Install the agent

Section titled “1. Install the agent”

The agent is the machine-side collector. Under Configure → Data Collection → Machine Management, choose Add Agent:

  • Manual install — the platform prints an install command; run it on the host (Linux, Windows, macOS). You can tag the machine now for later grouping.
  • Auto install — the platform installs over SSH (host must be reachable and have SSH enabled).
  • Docker / Kubernetes — a deploy command or a Helm chart for containers.

When the agent starts it reports back as Online. Full detail: Agent and machines.

2. Get data in — fastest with an app

Section titled “2. Get data in — fastest with an app”

The quickest first collection is an integration app. Open the catalog, install the app for what you monitor — a database, a middleware, a web server, or plain host metrics — and run its collection template. The metrics, logs, dashboards and alert prototypes arrive together.

No app for your data? Three other routes: point the agent at your logs (Log collection sources), let Sondar listen for pushed data (Listening collection), or upload a file (File upload).

Section titled “3. Search”

Open Search, pick an index, and type:

search2 index="_internal"

_internal is created at install and the platform writes its own activity there, so this returns rows on a brand-new instance before you have collected anything. Once your own data is arriving, search that index instead:

search2 index="app_logs" "connection refused"

Filter, group, and switch to the Visualization tab to see it as a chart. See Interactive search and, when you need more than one command, SonQL.

4. Save a dashboard

Section titled “4. Save a dashboard”

A query worth keeping belongs on a dashboard. From the search, save it as a report and add it to a dashboard; then add more charts, set the refresh and time range, and leave it up. See Dashboards.

5. Set an alert

Section titled “5. Set an alert”

An alert watches a search condition and notifies you. Create a rule (pick the metric or search, set the threshold and the severity), choose a notification channel — Slack, PagerDuty, email, and more — and confirm it fires. See Alerts and notifications.

6. Watch the platform itself

Section titled “6. Watch the platform itself”

The Monitoring Console shows the platform’s own health — cluster availability, query load, shard and disk state — for the administrator. See Monitoring console.

Next, per role

Section titled “Next, per role”