topic Perfmon not sending data in Getting Data In

Perfmon not sending data

stnorbert — Thu, 22 Sep 2011 03:26:59 GMT

Hi guys, little help with this amazing program.

I recently installed the universal forwarder onto two 32 bit windows server machines and it forwarded all the data i needed. since then I've expanded onto two windows server 64 bit machines. these are sending all other information aside from Perfmon data. i've done a little research and a little thinking and have tried :

http://docs.splunk.com/Documentation/Splunk/4.2.3/ReleaseNotes/Workaroundtoadd64-bitWindowsperfmoninputs

I restarted both splunk on the server and the local splunk service after this this has not worked 😞

all help much appreciated.

Re: Perfmon not sending data

stnorbert — Mon, 28 Sep 2020 09:55:16 GMT

Since the first time i asked this question a few more things i have tried:
Comparing the .conf (between the working 32-bit and non working 64-bit) files for the Universal Forwarder App and for the System, all of the .conf files where changed or the same.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Real-timeWindowsperformancemonitoring
Under: Configure local Windows performance monitoring with Splunk Web
The places this walktrhough point to i cannot find on my version of splunk (4.2.3)

splunkd.log is giving me :

09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:45.702 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
09-26-2011 19:57:48.286 +0800 ERROR TcpOutputProc - Can't find or illegal IP address or Name: pegasus
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:57.703 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

Re: Perfmon not sending data

stnorbert — Wed, 28 Sep 2011 08:13:37 GMT

Since last time i have tried Re-installing splunk (had some IP Addressing issues which have been resolved)

Changed the "object" value of Processor to Processor Information as provided helpfully here:

http://splunk-base.splunk.com/answers/28012/unable-to-pull-perfmon-counter-for-processor-time-windows-2003-32-bit

Since then the other errors have appeared

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - PerfmonHelper::enumObjectByNameEx: PdhEnumObjectItems failed for object - 'Memory' with error (0xc0000bb8): The specified object was not found on the computer.
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Unable to add counter '\Processor Information()\% Processor Time' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk()\Free Megabytes' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk(*)\% Free Space' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -

Then after the initial Errors it continues with the below indefinetly.

09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick

My Perfmon.conf is as follows:

[PERFMON:CPU Load]
counters = % Processor Time;% User Time
disabled = 0
instances = _Total
interval = 10
object = Processor Information

[PERFMON:Available Memory]
counters = Available Bytes
disabled = 0
interval = 10
object = Memory

[PERFMON:Free Disk Space]
counters = Free Megabytes;% Free Space
disabled = 0
instances = _Total
interval = 10
object = LogicalDisk

[PERFMON:Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
disabled = 0
instances = *
interval = 10
object = Network Interface