topic Re: Universal Forwarder not Forwarding Performance in Getting Data In

Universal Forwarder not Forwarding Performance

Rickmcvick31 — Tue, 13 Nov 2012 17:40:24 GMT

I have a receiver and one forwarder, the universal forwarder (Windows 7 box) sends logs (sys, app, etc) but will not send performance data. I have all the firewalls turned off, the ports are correct, and re-installed the forwarder. Nothing. Any Ideas?

Re: Universal Forwarder not Forwarding Performance

brokolice — Wed, 14 Nov 2012 11:44:04 GMT

Hi,

dealing with the same issue right now.

I've added this to the inputs.conf in directory of the Universal Forwarder. C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local

[perfmon://LocalPhysicalDisk]
interval = 30
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = main

[perfmon://LocalMainMemory]
interval = 30
object = Memory
counters = Committed Bytes; Available Bytes; % Committed Bytes In Use
disabled = 0
index = main

[perfmon://Processor]

interval = 60

object = Processor
counters = % Processor Time

instances = _Total

disabled = 0

index = main

kind of works, still playing around

Jiri

Re: Universal Forwarder not Forwarding Performance

matthewcanty — Wed, 28 Nov 2012 11:58:20 GMT

Have you got anywhere with this, not sure what the answers below are meant to mean.

Re: Universal Forwarder not Forwarding Performance

jsmander — Wed, 28 Nov 2012 22:22:54 GMT

I have the same problem - did you ever get to the bottom of it? Or did you stick with adding comments to the input.conf directly?

This seems like something Splunk would've heavily tested - did we miss something obvious?

Re: Universal Forwarder not Forwarding Performance

Rickmcvick31 — Wed, 28 Nov 2012 22:25:37 GMT

I am still working on it, however, the comments did not work in the .conf so I'm stuck with no performance data, save for the host PC.

Re: Universal Forwarder not Forwarding Performance

matthewcanty — Thu, 29 Nov 2012 09:33:50 GMT

I just put all my perfmon configurations straight into the inputs.conf. Worked a treat. Don't know why it works, or why it's not written down anywhere but there ya go.

Update:

This is as it appears in my inputs.conf -

[perfmon://Processor Information]
interval = 10
object = Processor Information
counters = % Processor Time;
instances = _Total
disabled = 0
index=daldevperfmon

In outputs.conf make sure you have the index setup:

[tcpout]
defaultGroup=daldevperfmon
disabled=false

[tcpout:daldevperfmon]
server=127.0.0.1:9997

HTH

Re: Universal Forwarder not Forwarding Performance

Rickmcvick31 — Thu, 29 Nov 2012 14:36:33 GMT

I have done that and I got nothing. I wonder if I am missing something obvious. Like the proverbial glowing button that says "click to enable performance data you dope"

Re: Universal Forwarder not Forwarding Performance

DaveSavage — Thu, 29 Nov 2012 15:19:35 GMT

Rick - I take it you have checked Computer Management (compmgmt.msc from the command line) and that under Services, 'Performance Logs and Alerts' is Started? Best make it persistent as well?
Br Dave

Re: Universal Forwarder not Forwarding Performance

Rickmcvick31 — Thu, 29 Nov 2012 15:38:30 GMT

hmm, well that may be the proverbial button, I started the service, we will see how it goes. Perhaps starting that service with the inputs.conf comments will work.

Re: Universal Forwarder not Forwarding Performance

DaveSavage — Thu, 29 Nov 2012 16:07:07 GMT

Good luck!I'll follow this thread to see if it worked & will change the question to 'a' (potential)answer to help others.

Re: Universal Forwarder not Forwarding Performance

Rickmcvick31 — Thu, 29 Nov 2012 19:20:35 GMT

I have, I haven't tried the comments in the inputs.conf in conjunction with turning on the services, but as of now when I check the performance of one of my forwarders, I get no info: click here. So when I click to see the search criteria I see this:

This search has completed, but did not match any events. The terms specified in the highlighted portion of the search:

search source=WMI:CPUTime host=JMETZGER-PC | eval CPULoad = PercentProcessorTime | timechart avg(CPULoad) min(CPULoad) max(CPULoad)

Re: Universal Forwarder not Forwarding Performance

DaveSavage — Fri, 30 Nov 2012 10:18:46 GMT

Rick. Ok - I assume that JMETZGER-PC is the source with the UF on it, not the host indexer, and that you still only see WMI:stuff from the latter...and that JMETZ..is sending other data through e.g. it confirms the UF started?
If the above is true then try 2 things:
1) deep dive into the Splunk internal indexes for perfmon errors using: index=_internal source=*splunkd.log perfmon
2) Just check that the PC with the UF on it does have Splunk running with system permissions - sufficient to initiate the performance monitor?
Br, Dave

Re: Universal Forwarder not Forwarding Performance

DaveSavage — Fri, 30 Nov 2012 10:39:21 GMT

Lastly - it is worth going the perfmon.conf route. Splunk docs has more on it here: http://docs.splunk.com/Documentation/Splunk/4.2.3/ReleaseNotes/Workaroundtoadd64-bitWindowsperfmoninputs
You may find that you don't have a perfmon.conf operational i.e. there is an example file in ../etc/system but not in /system/default..nor in your ../system/local as yet.
Use the example file as your template and save it to local per usual. Then restart the service.

Re: Universal Forwarder not Forwarding Performance

tirusplunk — Wed, 13 Nov 2013 09:46:37 GMT

Hi Brokolice,

Have you managed to get these counters and perfmons in the splunk indexer?

If yes, Can you please tell me how you did it?

Thanks & Regards,

Tirumal