Getting Data In

How to disable processes run frequently by Splunk universal forwarder?

lrhazi
Path Finder

I see that these commands are executed every minute:

splunk-powershell.exe
splunk-winprintmon.exe
splunk-regmon.exe
splunk-netmon.exe
splunk-admon.exe
splunk-MonitorNoHandle.exe

The first one actually twice per minute.

Is there a way to disable these? are these some scripted inputs? I cannot locate them in the config.

I tried adding this for example to my config, but did not seem to change the anything:

[WinNetMon]
disabled = 1
[WinPrintMon]
disabled = 1
[WinRegMon]
disabled = 1

nick405060
Motivator

The answers posted here work, but not if you have Splunk_TA_windows installed. For us, we had a full CPU taken up by splunk-netmon.exe on our Exchange server, that wouldn't get disabled if you set "interval = -1" or "disabled = 1" in etc/system/local/inputs.conf.

So I ran "./splunk cmd btool inputs list --debug | select-string netmon" and saw that I actually had to modify C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf, and set the two stanzas there to "disabled = 1". That did the trick!

0 Karma

lrhazi
Path Finder

Thank you mmodestino. This seems to work:

[perfmon]
interval = -1
[powershell]
interval = -1
[powershell2]
interval = -1
[admon]
interval = -1
[WinRegMon]
interval = -1
[WinNetMon]
interval = -1
[MonitorNoHandle]
interval = -1
[WinPrintMon]
interval = -1

Yunagi
Communicator

This answer has helped me too. As above I set all intervals to -1 in etc/system/local/inputs.conf. (Except WinEventLog because I monitor Windows Event Logs.)

I noticed that the file etc/system/default/inputs.conf on my Windows Universal Forwarder contains the following lines:

[admon]
interval=60
baseline=0

[MonitorNoHandle]
interval=60

[WinEventLog]
interval=60
evt_resolve_ad_obj = 0
evt_dc_name=
evt_dns_name=

[WinNetMon]
interval=60

[WinPrintMon]
interval=60

[WinRegMon]
interval=60
baseline=0

[perfmon]
interval=300

[powershell]
interval=60

[powershell2]
interval=60
0 Karma

helge
Builder
0 Karma

mattymo
Splunk Employee
Splunk Employee

6.5.2 fresh 32 bit win10 install, no inputs enabled during install, no windows TA, default stanzas enable the inputs, and process explorer says they spin up and die. you literally have to carve out it's guts to get them to never run. local disable, doesn't seem to work. will test again on disabling on local for 6.5.2, if it doesn't work, I'll submit an ER.

One workaround ive seen is setting interval to -1 so it they only run once..kind of meh as a solution, but I'm more comfortable with that, then telling you to lobotomize your forwarder.

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
- MattyMo
0 Karma

ddrillic
Ultra Champion

How do you submit an ER?

0 Karma

mattymo
Splunk Employee
Splunk Employee

as a client, you can submit it through the support portal. (P4 case severity)

- MattyMo
0 Karma

gjanders
SplunkTrust
SplunkTrust

Have you tried (in a command window open as administrator):

splunk btool inputs list  --debug

That should tell you which file is enabling the inputs, perhaps there is another inputs.conf file enabling these inputs that you are not noticing...

0 Karma

lrhazi
Path Finder

I did, not sure I can identify the ones responsible for these programs..
The ones I suspected are the ones I tried to disable, see my original post, but to no avail.

$ cat   /cygdrive/d/LogServer/foo.txt | grep '\['
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [MonitorNoHandle]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [SSL]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinEventLog]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Application]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Security]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://System]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\...stash_new]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [blacklist:C:\Program Files\SplunkUniversalForwarder\etc\auth]
C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                          [default]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [fschange:C:\Program Files\SplunkUniversalForwarder\etc]
C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inputs.conf         [http]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\license_usage_summary.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [perfmon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell2]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script://C:\Program Files\SplunkUniversalForwarder\bin\scripts\splunk-wmi.path]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [splunktcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [tcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [udp]
0 Karma

gjanders
SplunkTrust
SplunkTrust

Under:
[WinNetMon]
[WinPrintMon]
[WinRegMon]

Do you see the disabled = 1 ?

0 Karma

lrhazi
Path Finder

You're right, I don't see that! it ignored my input stanzas in :

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf

for example:

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
0 Karma

gjanders
SplunkTrust
SplunkTrust

Oh ok so something has put that into the system\default entries, the system\local entries could override it. I'm guessing this was an older forwarder installation that included the windows TA?

Perhaps you could uninstall/re-install the forwarder and just re-deploy the Windows TA (or automatically if your already sending it down from a deployment server).

0 Karma

lrhazi
Path Finder

Thanks. I will try the fresh reinstall idea. without adding any app at all.

0 Karma

lrhazi
Path Finder

An uninstall/reinstall seems to fix the issue!
Now, I added that TA app back and the issue still did not re-appear!!!
Very odd... Thank you all anyways 🙂

0 Karma

lrhazi
Path Finder

What's odd is that performing an uninstall then fresh install, and problem is gone.

Add Splunk_TA_windows app, restart agent, and problem appears (commands execute every minute)

Remove Splunk_TA_windows app, restart Splunk agent, and issue still continues!! (commands continue to execute every minute)!!!

0 Karma

gjanders
SplunkTrust
SplunkTrust

How are you installing Splunk TA windows? If your just dropping in the file from the deployment server removing the app and restarting should emove all related schedules/scripts.

0 Karma

lrhazi
Path Finder

I simply drop the TA folder into the /etc/apps folder. To uninstall I just remove that folder.

To remove the TA app, do I need to remove other things from other places? besides the app's subfolder?

Thanks,
Mohamed.

0 Karma

gjanders
SplunkTrust
SplunkTrust

No, that should work! As long as you restart the forwarder afterward.

0 Karma

mattymo
Splunk Employee
Splunk Employee

in my latest experience the forwarder needed a lobotomy to get it to stop. going to test with 6.5.2 which ships with the traditional inputs disabled, but they are present despite the windows TA...

- MattyMo
0 Karma

mattymo
Splunk Employee
Splunk Employee

what version of the forwarder are you on? The newer versions don't install windows monitors by default more, IIRC. Checking...

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...