All Apps and Add-ons

What's the performance impact of high-frequency performance sampling for Windows perfmon?

Path Finder

For the Windows perfmon input, I see that there's a setting that can enable high-frequency performance sampling. From the spec:

Enables high-frequency performance sampling. The input collects performance data every sampling interval. It then reports averaged data and other statistics at every interval.
The minimum legal value is 100 ...
Defaults to not specified (disabled)

I assume it's disabled by default because it generates an additional load on the forwarder, but I can't find anything that talks about what that load might be. Does anyone have an idea what kind of impact enabling this would have?

0 Karma

SplunkTrust
SplunkTrust

it actually generates load on the windows host.
think about it this way, you are collecting many performance metrics and counters via a script. you are invoking many scripts in very short intervals. That generates load on the host.
if you need very high intervals, consider maybe collectd or statsd and use some metrics power:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Metrics/GetStarted

0 Karma

Builder

in addition to CPU time associated with sample taking, If you are using multikv perfmon inputs there will also be an implication to memory utilization by the perfmon collector. The sample data has to be held in memory in order to compute multi-kv stats at the end of the event interval.

0 Karma

Path Finder

Thanks for this - multikv was another item I was interested in since it apparently reduces the amount of data indexed (which would be worth the memory cost on the Windows servers).

0 Karma

Splunk Employee
Splunk Employee

I apologize @ranazar. In moving @adonio's comment to an answer, I accidentally deleted a comment thread. Newb move. My bad!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!