topic Re: perfmon no longer working? in Getting Data In

perfmon no longer working?

twinspop — Thu, 02 Jun 2011 22:38:48 GMT

Installed via command line with:

msiexec /I splunk...msi /qn ALLUSERS=1 REBOOT=ReallySuppress AGREETOLICENSE=Yes RECEIVING_INDEXER="indexer:7900"

myapp/defaults/inputs.conf:

[monitor://C:\WINNT\system32\LogFiles\HTTPERR]
disabled = false
sourcetype = iishttperr
ignoreOlderThan = 3d

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = false

myapp/defaults/perfmon.conf:

[PERFMON:Web Stats]
counters = Total Connection Attempts;Total Method Requests;Total Bytes Sent
disabled = false
instances = _Total
interval = 300
object = Web Service

Splunkd.log says:

06-02-2011 15:25:15.893 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Web Service(*)\Total Connection Attempts'  error 0xc0000bb9
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" splunk-regmon - No enabled entries were found in the conf files.
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" Using logging configuration at C:\Program Files\SplunkUniversalForwarder\etc\log-cmdline.cfg.

Re: perfmon no longer working?

mw — Mon, 28 Sep 2020 09:38:30 GMT

I'm no perfmon expert, but that error is:
0xC0000BB9 (PDH_CSTATUS_NO_COUNTER) The specified counter could not be found.

So, I'd imagine that your "Total Connection Attempts" counter isn't valid or isn't enabled. Maybe "Attempts" should be "attempts" (based on a some Googling and a little faith)?

Re: perfmon no longer working?

twinspop — Thu, 02 Jun 2011 23:08:40 GMT

I was chasing my tail here. Apparently nothing is being logged from this SUF any longer. I saw the lack of perfmon entries first, and that log entry and focused in on that. But no log entries from even the most basic text file are making it to the indexer. Back to the drawing board. Thanks for the help on spotting my bad perfmon entry.