https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/505598#M86131 <P>Did you happen to find a solution to this? I'm encountering a similar issue.</P> Mon, 22 Jun 2020 19:46:02 GMT mwehle_splunk 2020-06-22T19:46:02Z https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/478307#M82119 <P>Since we upgrades our UF to v7.2.9, we are seeing lots of application crash errors in the application event log on our hosts. This is happening on large volumes of hosts. Initially I thought it may be a specific counter, but it occurs when the Splunk-Perfmon.exe process is running, even if no perfmon collection is occurring. I don't see any errors in Splunk itself and the Splunk-Perfmon process itself keeps running and sending data. Looking into these errors, there seems to be some suggestion this is related to "data execution prevention" which is blocking Splunk trying to run code in data memory (error include code c0000005 which is an access denied error) , but I have not been able to confirm this. servers previously running v6 did not show this error, only when upgraded did the error start to appear.</P> <P>example error below</P> <P>SourceName=Windows Error Reporting<BR />EventCode=1001<BR />EventType=4<BR />Type=Information<BR />ComputerName=xxxxxxxxxxxx<BR />TaskCategory=The operation completed successfully.<BR />OpCode=Info<BR />RecordNumber=230239<BR />Keywords=Classic<BR />Message=Fault bucket , type 0<BR />Event Name: APPCRASH<BR />Response: Not available<BR />Cab Id: 0</P> <P>Problem signature:<BR />P1: splunk-perfmon.exe<BR />P2: 1794.2305.24028.63924<BR />P3: 5ddcfc22<BR />P4: splunk-perfmon.exe<BR />P5: 1794.2305.24028.63924<BR />P6: 5ddcfc22<BR />P7: c0000005<BR />P8: 00000000005bc5d8<BR />P9: <BR />P10:</P> <P>Attached files:</P> <P>These files may be available here:<BR />C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_splunk-perfmon.e_2f9ed6fb118b57ac0e734f67ff573c73ad1654a_64da0b14_48835327</P> Mon, 27 Feb 2023 14:31:45 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/478307#M82119 wyfwa4 2023-02-27T14:31:45Z https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/505598#M86131 <P>Did you happen to find a solution to this? I'm encountering a similar issue.</P> Mon, 22 Jun 2020 19:46:02 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/505598#M86131 mwehle_splunk 2020-06-22T19:46:02Z https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/553093#M91719 <P>I can see the exact same issue with forwarders +8, but only on Win Servers 2019. Has anyone found a fix ?</P> Wed, 26 May 2021 09:00:32 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/553093#M91719 nunoaragao 2021-05-26T09:00:32Z https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/632242#M108318 <P>We are also experiencing the same issue on Windows Server 2019 with UF 7.3.71. Any updates to this?</P> Fri, 24 Feb 2023 19:11:49 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-Splunk-Perfmon-crash-errors-in-forwarder-7-2-9/m-p/632242#M108318 avisram_takeda 2023-02-24T19:11:49Z