topic Re: How to collect perfmon data on .NET counters? in Getting Data In

How to collect perfmon data on .NET counters?

anewell — Mon, 13 Oct 2014 23:22:57 GMT

I am attempting to collect perfmon counters to track garbage collection in a .NET application. I can create the counter locally in the Windows perfmon GUI, so I believe the data ought to be exposed to the Splunk perfmon modular input. However, the inputs.conf stanza I've created does not work, and returns no errors.

[perfmon://NETGarbageCollection]
counters = NumberGen2Collections
disabled = false
instances = *
interval = 60
object = Win32_PerfFormattedData_NETFramework_NETCLRMemory
index = test

I have also tried running a WMI query directly from the splunk-wmi.exe helper executable (a technique I've used successfully before)

PS C:\Program Files\SplunkUniversalForwarder\bin> & .\splunk-wmi.exe -wql "SELECT * FROM Win32_PerfFormattedData_NETFram
ework_NETCLRMemory"

Clean shutdown completed.

PS C:\Program Files\SplunkUniversalForwarder\bin> & .\splunk-wmi.exe -wql "SELECT NumberGen2Collections FROM Win32_PerfF
ormattedData_NETFramework_NETCLRMemory"

Clean shutdown completed.

My developers are hoping to use the counter information to debug a problem in our production software, and so there is considerable interest in getting this working.

I am collecting perfmon on a Universal Forwarder which is otherwise working as expected. Indexer and forwarder are both running Splunk 6.0.3, OS is Windows server 2012, .NET is 4.5. I've been taking my perfmon counter names and object paths from this reference.

Thanks!

Re: How to collect perfmon data on .NET counters?

anewell — Mon, 13 Oct 2014 23:27:32 GMT

The markup for my Reference link isn't rendering properly. Link: http://wutils.com/wmi/root/CIMV2/CIM_StatisticalInformation/Win32_Perf/Win32_PerfFormattedData/Win32_PerfFormattedData_NETFramework_NETCLRMemory.html

Re: How to collect perfmon data on .NET counters?

anewell — Thu, 23 Oct 2014 22:37:37 GMT

Found a workaround, in the form of a scripted input run on the forwarder. (The regex is to select IIS-related counters, which happen to be what I'm after)

The script outputs a table of each IIS process and it's "# Gen 2 Collections" perfmon counter:

#! powershell
$gc2 = get-counter -Counter "\.NET CLR Memory(w3wp*)\# Gen 2 Collections"
[regex]$regex = 'w3wp(\#\d)?'
$arrCounterPath = $gc2.CounterSamples | %{ $regex.match($_.Path) } | %{$_.value}
$output = @{}
for ($i=0; $i -lt $gc2.CounterSamples.count; $i++) {
        $output.add($arrCounterPath[$i], $gc2.CounterSamples[$i].CookedValue)
    }

#  tabular output is fine for splunk; run through "multikv" search command.
write-output $output

Re: How to collect perfmon data on .NET counters?

Goldbeed — Wed, 27 Jun 2018 21:55:11 GMT

This is what I used to ingest the data

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 10
object=.NET CLR Memory
useEnglishOnly=true,This is what I Used to gather the data into splunk.

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 5
object=.NET CLR Memory
useEnglishOnly=true,This is what I used to gather the content for splunk

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 5
object=.NET CLR Memory
useEnglishOnly=true