topic WMI vs Perfmon: No Local Processes? in Getting Data In

WMI vs Perfmon: No Local Processes?

adamw — Thu, 24 Mar 2011 22:02:17 GMT

I noticed while comparing the default configs for WMI and Perfmon that there's a LocalProcesses query in WMI that lacks a corresponding entry in Perfmon. It seems unique in this regard and I'm wondering if there's a reason it's not there.

Is there something I'm missing?

Re: WMI vs Perfmon: No Local Processes?

proctorgeorge — Thu, 07 Apr 2011 21:23:40 GMT

Perfmon does usually have a Process Query, you would have to add the counter for it in perfmon.conf. The entry would look something like this:

[PERFMON:Process Monitor]
counters = ID Process;% User Time
disabled = 0
instances = *
interval = 10
object = Process
index = some_Index

The instances field could be * (all processes) like mine or a specific process, ex. notepad, splunkd, or explorer. The Counters field would be aspects you want to monitor of the process, PID, Memory Usage, CPU Usage, etc.

EDIT: Switched the counters and object, got messed up in translation. It is correct now, or look at Dokian's, Thx Dokian!

EDITx2: Clarity/Grammar

Re: WMI vs Perfmon: No Local Processes?

dokian — Fri, 08 Apr 2011 09:22:14 GMT

I was hanging out for an answer to this question. Thanks for the response!

I needed to make a slight change to get it working though:

[PERFMON:Process Monitor]
counters = ID Process;% User Time
disabled = 0
instances = *
interval = 10
object = Process

The values for counters and object needed to be swapped.

Re: WMI vs Perfmon: No Local Processes?

fervin — Wed, 18 May 2011 01:29:35 GMT

Are you noticing that only processes run by SYSTEM show up? We are noticing this in our environment.