Deployment Architecture

splunk-regmon Running in UniversalForwarder when not monitoring the Registry

Path Finder

Hi,

We are currently not monitoring for Registry items on our UniversalForwarder, but the indexer that is receiving windows events from the forwarder is telling us that the splunk-regmon executable is running, I am guessing its default number of times per hour.

How is this disabled so that regmon is not started when we do not monitor for these items.

Thx.

0 Karma
1 Solution

Contributor

I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.

View solution in original post

0 Karma

Contributor

I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.

View solution in original post

0 Karma

Path Finder

I'll check back with support to get confirmation if it was fixed in either of the newer versions.

thx.

0 Karma

Path Finder

I was told by support that SPL-92479 was fixed as of Jan 23, 2015.

0 Karma

Contributor

What version of the UF was released on or after that date?

0 Karma

Path Finder

Splunk just released 6.2.3 as of May 1st, and 6.2.2 was some time after Jan 23rd, I believe.

I haven't installed the UF yet to verify if its fixed there.

However, I don't know if this is my problem because I am also seeing this in my indexer with both 6.2.1 and 6.2.3.

I'm seeing this with at least the Registry monitor, host print monitor, and network monitor.

0 Karma

Contributor

What version of UF are you running?

0 Karma

Path Finder

We are using Splunk 6.2.1 on both Indexers and UF. Both are showing regmon running every minute.

The indexer is even showing the default Registry monitoring items as disabled.

Thx for any help.

0 Karma