All Apps and Add-ons

What's the performance impact of high-frequency performance sampling for Windows perfmon?

Ranazar
Path Finder

For the Windows perfmon input, I see that there's a setting that can enable high-frequency performance sampling. From the spec:

Enables high-frequency performance sampling. The input collects performance data every sampling interval. It then reports averaged data and other statistics at every interval.
The minimum legal value is 100 ...
Defaults to not specified (disabled)

I assume it's disabled by default because it generates an additional load on the forwarder, but I can't find anything that talks about what that load might be. Does anyone have an idea what kind of impact enabling this would have?

0 Karma

adonio
Ultra Champion

it actually generates load on the windows host.
think about it this way, you are collecting many performance metrics and counters via a script. you are invoking many scripts in very short intervals. That generates load on the host.
if you need very high intervals, consider maybe collectd or statsd and use some metrics power:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Metrics/GetStarted

0 Karma

dstaulcu
Builder

in addition to CPU time associated with sample taking, If you are using multikv perfmon inputs there will also be an implication to memory utilization by the perfmon collector. The sample data has to be held in memory in order to compute multi-kv stats at the end of the event interval.

0 Karma

Ranazar
Path Finder

Thanks for this - multikv was another item I was interested in since it apparently reduces the amount of data indexed (which would be worth the memory cost on the Windows servers).

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

I apologize @ranazar. In moving @adonio's comment to an answer, I accidentally deleted a comment thread. Newb move. My bad!!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...