https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151095#M30745 <P>I have ~ 800 windows servers getting their configs from a deployment server. Often when i roll a new version of the perf app out, and splunk restarts, perfmon targets stop logging completely from some hosts. Splunk UF version 4.3-6.0 running on Windows 2003-2008.</P> <P>Why? Is there a known workaround?</P> <P>EDIT: Non-perfmon targets continue to work normally on these servers</P> <P>EDIT2:</P> <P>inputs.conf</P> <PRE><CODE>[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] disabled = 0 </CODE></PRE> <P>perfmon.conf</P> <PRE><CODE>[PERFMON:CPU] counters = % Processor Time disabled = 0 instances = _Total interval = 60 object = Processor index = perf </CODE></PRE> Mon, 21 Jul 2014 16:40:27 GMT twinspop 2014-07-21T16:40:27Z https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151095#M30745 <P>I have ~ 800 windows servers getting their configs from a deployment server. Often when i roll a new version of the perf app out, and splunk restarts, perfmon targets stop logging completely from some hosts. Splunk UF version 4.3-6.0 running on Windows 2003-2008.</P> <P>Why? Is there a known workaround?</P> <P>EDIT: Non-perfmon targets continue to work normally on these servers</P> <P>EDIT2:</P> <P>inputs.conf</P> <PRE><CODE>[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] disabled = 0 </CODE></PRE> <P>perfmon.conf</P> <PRE><CODE>[PERFMON:CPU] counters = % Processor Time disabled = 0 instances = _Total interval = 60 object = Processor index = perf </CODE></PRE> Mon, 21 Jul 2014 16:40:27 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151095#M30745 twinspop 2014-07-21T16:40:27Z https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151096#M30746 <P>they have different syntax , if not migrated properly they wont forward the data. </P> <P>include perfmon in the inputs.conf file and restart</P> Mon, 21 Jul 2014 17:11:58 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151096#M30746 linu1988 2014-07-21T17:11:58Z https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151097#M30747 <P>They all have identical settings. Let's just focus on the 6.0 SUF servers. Some work and some don't. They have identical configs. Reboots don't cure the problem.</P> Mon, 21 Jul 2014 20:05:15 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151097#M30747 twinspop 2014-07-21T20:05:15Z https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151098#M30748 <P>After splunk 5 there is no perfmon.conf. While upgrading some gets migrated to inputs.conf. sometimes if the migration doesn't happen properly then they don't forward. The configurations are case sensitive.</P> <P>Replace like below.</P> <P><CODE>[perfmon://CPU]<BR /> counters = % Processor Time<BR /> disabled = 0<BR /> instances = _Total<BR /> interval = 60<BR /> object = Processor<BR /> index = perf</CODE></P> <P>Thanks,<BR /> L</P> Tue, 22 Jul 2014 02:39:32 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151098#M30748 linu1988 2014-07-22T02:39:32Z https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151099#M30749 <P>Thank you! I didn't grok what you were saying in the first comment. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 22 Jul 2014 03:50:15 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Universal-Forwarder-stopped-logging-perfmon-How-can-I/m-p/151099#M30749 twinspop 2014-07-22T03:50:15Z