All Apps and Add-ons

What's the performance impact of high-frequency performance sampling for Windows perfmon?

Ranazar
Path Finder

For the Windows perfmon input, I see that there's a setting that can enable high-frequency performance sampling. From the spec:

Enables high-frequency performance sampling. The input collects performance data every sampling interval. It then reports averaged data and other statistics at every interval.
The minimum legal value is 100 ...
Defaults to not specified (disabled)

I assume it's disabled by default because it generates an additional load on the forwarder, but I can't find anything that talks about what that load might be. Does anyone have an idea what kind of impact enabling this would have?

0 Karma

adonio
Ultra Champion

it actually generates load on the windows host.
think about it this way, you are collecting many performance metrics and counters via a script. you are invoking many scripts in very short intervals. That generates load on the host.
if you need very high intervals, consider maybe collectd or statsd and use some metrics power:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Metrics/GetStarted

0 Karma

dstaulcu
Builder

in addition to CPU time associated with sample taking, If you are using multikv perfmon inputs there will also be an implication to memory utilization by the perfmon collector. The sample data has to be held in memory in order to compute multi-kv stats at the end of the event interval.

0 Karma

Ranazar
Path Finder

Thanks for this - multikv was another item I was interested in since it apparently reduces the amount of data indexed (which would be worth the memory cost on the Windows servers).

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

I apologize @ranazar. In moving @adonio's comment to an answer, I accidentally deleted a comment thread. Newb move. My bad!!

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...