topic Re: How to disable processes run frequently by Splunk universal forwarder? in Getting Data In

How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Tue, 21 Mar 2017 20:13:06 GMT

I see that these commands are executed every minute:

splunk-powershell.exe
splunk-winprintmon.exe
splunk-regmon.exe
splunk-netmon.exe
splunk-admon.exe
splunk-MonitorNoHandle.exe

The first one actually twice per minute.

Is there a way to disable these? are these some scripted inputs? I cannot locate them in the config.

I tried adding this for example to my config, but did not seem to change the anything:

[WinNetMon]
disabled = 1
[WinPrintMon]
disabled = 1
[WinRegMon]
disabled = 1

Re: How to disable processes run frequently by Splunk universal forwarder?

mattymo — Tue, 21 Mar 2017 23:08:25 GMT

what version of the forwarder are you on? The newer versions don't install windows monitors by default more, IIRC. Checking...

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Tue, 21 Mar 2017 23:42:23 GMT

C:\Program Files\SplunkUniversalForwarder\bin>.\splunk version
Splunk Universal Forwarder 6.5.1 (build f74036626f0c)

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Tue, 29 Sep 2020 13:22:16 GMT

I did add Splunk_TA_windows app, but then realized that even if I remove it and restart the service, these programs continue to run just as frequently....

Re: How to disable processes run frequently by Splunk universal forwarder?

mattymo — Wed, 22 Mar 2017 00:09:05 GMT

yeah it looks as if the process spins up just to realize it doesn't have to run.

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 00:12:13 GMT

That would makes sense indeed. Thanks.
I hope someone figured out how to disable this behavior...

Re: How to disable processes run frequently by Splunk universal forwarder?

gjanders — Wed, 22 Mar 2017 01:05:26 GMT

Have you tried (in a command window open as administrator):

splunk btool inputs list  --debug

That should tell you which file is enabling the inputs, perhaps there is another inputs.conf file enabling these inputs that you are not noticing...

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 02:32:21 GMT

I did, not sure I can identify the ones responsible for these programs..
The ones I suspected are the ones I tried to disable, see my original post, but to no avail.

$ cat   /cygdrive/d/LogServer/foo.txt | grep '\['
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [MonitorNoHandle]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [SSL]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinEventLog]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Application]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Security]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://System]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\...stash_new]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [blacklist:C:\Program Files\SplunkUniversalForwarder\etc\auth]
C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                          [default]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [fschange:C:\Program Files\SplunkUniversalForwarder\etc]
C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inputs.conf         [http]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\license_usage_summary.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [perfmon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell2]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script://C:\Program Files\SplunkUniversalForwarder\bin\scripts\splunk-wmi.path]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [splunktcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [tcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [udp]

Re: How to disable processes run frequently by Splunk universal forwarder?

gjanders — Wed, 22 Mar 2017 02:36:43 GMT

Under:
[WinNetMon]
[WinPrintMon]
[WinRegMon]

Do you see the disabled = 1 ?

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 02:46:11 GMT

You're right, I don't see that! it ignored my input stanzas in :

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf

for example:

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60

Re: How to disable processes run frequently by Splunk universal forwarder?

gjanders — Wed, 22 Mar 2017 02:52:48 GMT

Oh ok so something has put that into the system\default entries, the system\local entries could override it. I'm guessing this was an older forwarder installation that included the windows TA?

Perhaps you could uninstall/re-install the forwarder and just re-deploy the Windows TA (or automatically if your already sending it down from a deployment server).

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 02:59:22 GMT

Thanks. I will try the fresh reinstall idea. without adding any app at all.

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 03:53:51 GMT

An uninstall/reinstall seems to fix the issue!
Now, I added that TA app back and the issue still did not re-appear!!!
Very odd... Thank you all anyways 🙂

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Tue, 29 Sep 2020 13:22:39 GMT

What's odd is that performing an uninstall then fresh install, and problem is gone.

Add Splunk_TA_windows app, restart agent, and problem appears (commands execute every minute)

Remove Splunk_TA_windows app, restart Splunk agent, and issue still continues!! (commands continue to execute every minute)!!!

Re: How to disable processes run frequently by Splunk universal forwarder?

gjanders — Wed, 22 Mar 2017 23:47:01 GMT

How are you installing Splunk TA windows? If your just dropping in the file from the deployment server removing the app and restarting should emove all related schedules/scripts.

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Wed, 22 Mar 2017 23:59:19 GMT

I simply drop the TA folder into the /etc/apps folder. To uninstall I just remove that folder.

To remove the TA app, do I need to remove other things from other places? besides the app's subfolder?

Thanks,
Mohamed.

Re: How to disable processes run frequently by Splunk universal forwarder?

gjanders — Thu, 23 Mar 2017 00:04:05 GMT

No, that should work! As long as you restart the forwarder afterward.

Re: How to disable processes run frequently by Splunk universal forwarder?

mattymo — Thu, 23 Mar 2017 03:54:18 GMT

in my latest experience the forwarder needed a lobotomy to get it to stop. going to test with 6.5.2 which ships with the traditional inputs disabled, but they are present despite the windows TA...

Re: How to disable processes run frequently by Splunk universal forwarder?

mattymo — Thu, 23 Mar 2017 04:26:03 GMT

6.5.2 fresh 32 bit win10 install, no inputs enabled during install, no windows TA, default stanzas enable the inputs, and process explorer says they spin up and die. you literally have to carve out it's guts to get them to never run. local disable, doesn't seem to work. will test again on disabling on local for 6.5.2, if it doesn't work, I'll submit an ER.

One workaround ive seen is setting interval to -1 so it they only run once..kind of meh as a solution, but I'm more comfortable with that, then telling you to lobotomize your forwarder.

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60

Re: How to disable processes run frequently by Splunk universal forwarder?

lrhazi — Thu, 23 Mar 2017 12:24:40 GMT

Thank you mmodestino. This seems to work:

[perfmon]
interval = -1
[powershell]
interval = -1
[powershell2]
interval = -1
[admon]
interval = -1
[WinRegMon]
interval = -1
[WinNetMon]
interval = -1
[MonitorNoHandle]
interval = -1
[WinPrintMon]
interval = -1