Is there any reason to use Perfmon over WMI on a universal forwarder when monitoring local data?

[philwhite]

Is there any reason to use Perfmon over WMI on a Universal Forwarder when monitoring local data? Perfmon gets it's data from WMI anyways, so why add the extra step of using Perfmon when you can just hit up WMI directly? I am considering editing my Windows TA to only use WMI (ie wmi.conf) and turning off perfmon. Does anyone see any issue with this?

[dstaulcu · Accepted solution]

Hello

The perfmon handler has a few advantages over WMI. For one, it's what's used in splunk_ta_windows (currently) and thus a few applications (windows infrastructure, ITSI, XenDesktop) are expecting inputs in non-compressed perfmon format. If you are more concerned with license utilization and bandwidth utilization than app compatibility, perfmon's multi-kv option allows for compression of multiple counters and sample-interval statistics in a single event/packet.

[philwhite]

Thank you.