Archive

Why is "WinHostMon://Application" input no longer working in 6.3?

Engager

When the "WinHostMon://Application" input is used in Splunk Enterprise 6.3 it appears to be ignored by the forwarder and no data is collected.

1 Solution

Splunk Employee
Splunk Employee

"WinHostMon://Application" input was deprecated in 6.3.

The Windows host monitor input has been modified to no longer monitor the state of installed applications.

Due to a bug in the system call that Splunk Enterprise uses to monitor application state, the Windows Installer service attempts to reconfigure all installed applications. In some cases this also appeared to cause performance issues.

When you upgrade, any Windows host monitoring input stanzas that reference the "Application" attribute will no longer function.

To get application state data, use the Windows Event Log monitor and search for Event ID Nos. 11707 (for installation) or 11724 (for uninstallation/removal.)

It may also be possible to use a powershell scripted input (Get-WmiObject -Class Win32_Product | Format-List -Property Name,InstallDate,InstallLocation,PackageCache,Vendor,Version,IdentifyingNum) or WMIC (wmic product get name,version,installdate).

This issue was reported in the following link:
The Windows Host Monitoring input no longer monitors application state

View solution in original post

Splunk Employee
Splunk Employee

"WinHostMon://Application" input was deprecated in 6.3.

The Windows host monitor input has been modified to no longer monitor the state of installed applications.

Due to a bug in the system call that Splunk Enterprise uses to monitor application state, the Windows Installer service attempts to reconfigure all installed applications. In some cases this also appeared to cause performance issues.

When you upgrade, any Windows host monitoring input stanzas that reference the "Application" attribute will no longer function.

To get application state data, use the Windows Event Log monitor and search for Event ID Nos. 11707 (for installation) or 11724 (for uninstallation/removal.)

It may also be possible to use a powershell scripted input (Get-WmiObject -Class Win32_Product | Format-List -Property Name,InstallDate,InstallLocation,PackageCache,Vendor,Version,IdentifyingNum) or WMIC (wmic product get name,version,installdate).

This issue was reported in the following link:
The Windows Host Monitoring input no longer monitors application state

View solution in original post

New Member

Hi , i have the same problem.
How did you resolved?
Thanks a lot!

0 Karma

Path Finder

@rostendorf, the link doesn't seem to work anymore? Can you edit it to the correct location?

0 Karma

Communicator

To find these things just have a look in the docs for the version mentioned (v6.3) and goto "Release Notes - Deprecated Features". At the bottom you find the following link

There's additional info for NOT using Get-WmiObject -class Win32_Product(https://support.microsoft.com/en-gb/help/974524/event-log-message-indicates-that-the-windows-install...) as it does the same as WinHostMon://Applicationdid: reconfiguring applications.

0 Karma