topic Universal Forwarder (Windows) dont forward performance data in All Apps and Add-ons

Universal Forwarder (Windows) dont forward performance data

wplank — Fri, 15 Jul 2011 07:59:13 GMT

Hey all,

i setup a universal forwarder on a Windows 7 System, logs get forwarded to the Splunk server, but no performance data.

How do i configure the universal forwarder to forward also Performance Data (CPU, RAM, ...)

Thanks for your help!

Re: Universal Forwarder (Windows) dont forward performance data

nembela — Fri, 15 Jul 2011 09:30:32 GMT

Hi,

My solution is not to elegant, but it works.
I configured the performance monitoring on the Splunk indexer from web UI.
The I copied the required stanzas from the perfmon.conf of the indexer to the splunk forwarder: $SPLUNKFORWARDER_HOME/etc/systekm/local/perfmon.conf

For example:

[PERFMON:Available Memory]

counters = Available Bytes
disabled = 0

interval = 10

object = Memory

index = performance

We use different index for performance data because of the different archiving policy

I hope it helps you

Re: Universal Forwarder (Windows) dont forward performance data

wplank — Fri, 15 Jul 2011 10:26:10 GMT

Hey,
thanks for your suggestion.

I already added a perfmon.conf on the splunk forwarder /etc/system/local/ directory.
Settings:
[Perfmon:LocalPhysicalDisk]
interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Wirte Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

But nothing appears in the index (perfmon).

Re: Universal Forwarder (Windows) dont forward performance data

malmoore — Fri, 15 Jul 2011 16:54:13 GMT

Hi wplank,

If I'm reading your perfmon.conf right, your interval is set to 0. Try setting it to something greater than 0.

Failing that, you might have a network connectivity issue. Can you telnet to the receiver's IP address and port from the machine running the UF?

Re: Universal Forwarder (Windows) dont forward performance data

wplank — Mon, 18 Jul 2011 07:15:10 GMT

Hello,

i changed the interval setting to 5 without success.
Telnet to splunkserver port 9997 tells me "no connection possible".

But the Forwarder forwards Security Logs (for example).

Re: Universal Forwarder (Windows) dont forward performance data

wplank — Mon, 18 Jul 2011 12:44:37 GMT

Is it even possible to track performance data from windows due the universal forwarder?

Re: Universal Forwarder (Windows) dont forward performance data

malmoore — Mon, 18 Jul 2011 17:05:39 GMT

Yes, you absolutely can forward performance log data from a universal forwarder.

"No connection possible" is a problem. If you're unable to telnet to that port, then no data at all is getting across. You may be seeing log data from other forwarders.

Is Windows Firewall running? If so, make sure those ports are open, or add the Splunk services to the list of allowed programs. If you can, stop WF temporarily and try the connection again.

Re: Universal Forwarder (Windows) dont forward performance data

wplank — Tue, 19 Jul 2011 07:46:07 GMT

I disable the firewall, without success.. telnet seems to working now but still no data. Is there a tutorial how to setup a universal forwarder for windows (without wmi) to trace perfromance data?

Re: Universal Forwarder (Windows) dont forward performance data

malmoore — Wed, 20 Jul 2011 00:37:52 GMT

Ok, that's a step in the right direction.

Did you install the UF as the Local System user, or another user?

If you installed as the Local System user, WMI shouldn't be in the mix at all here. If you place the perfmon.conf that you have shown above in %SPLUNKFORWARDER_HOME%\etc\system\local, it should collect data for the attributes specified in that file.

Information on editing perfmon.conf is here: http://www.splunk.com/base/Documentation/latest/Data/Real-timeWindowsperformancemonitoring#Configure_local_Windows_performance_monitoring_with_configuration_files

Let me know if this helps.

Re: Universal Forwarder (Windows) dont forward performance data

sloshburch — Thu, 02 May 2019 12:50:32 GMT

Although this answer was never 'accepted', it sounds like the right path. Here's some additional information to support the same line of solution: How do I get basic performance data for my Windows systems?, Is it a best practice to use the Splunk Add-on for Microsoft Windows? and What are the best practices for installing Splunk on Windows endpoints?