How to disable processes run frequently by Splunk universal forwarder?

[lrhazi]

I see that these commands are executed every minute:

splunk-powershell.exe
splunk-winprintmon.exe
splunk-regmon.exe
splunk-netmon.exe
splunk-admon.exe
splunk-MonitorNoHandle.exe

The first one actually twice per minute.

Is there a way to disable these? are these some scripted inputs? I cannot locate them in the config.

I tried adding this for example to my config, but did not seem to change the anything:

[WinNetMon]
disabled = 1
[WinPrintMon]
disabled = 1
[WinRegMon]
disabled = 1

[nick405060]

The answers posted here work, but not if you have Splunk_TA_windows installed. For us, we had a full CPU taken up by splunk-netmon.exe on our Exchange server, that wouldn't get disabled if you set "interval = -1" or "disabled = 1" in etc/system/local/inputs.conf.

So I ran "./splunk cmd btool inputs list --debug | select-string netmon" and saw that I actually had to modify C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf, and set the two stanzas there to "disabled = 1". That did the trick!

[lrhazi]

Thank you mmodestino. This seems to work:

[perfmon]
interval = -1
[powershell]
interval = -1
[powershell2]
interval = -1
[admon]
interval = -1
[WinRegMon]
interval = -1
[WinNetMon]
interval = -1
[MonitorNoHandle]
interval = -1
[WinPrintMon]
interval = -1

[Yunagi]

This answer has helped me too. As above I set all intervals to -1 in etc/system/local/inputs.conf. (Except WinEventLog because I monitor Windows Event Logs.)

I noticed that the file etc/system/default/inputs.conf on my Windows Universal Forwarder contains the following lines:

[admon]
interval=60
baseline=0

[MonitorNoHandle]
interval=60

[WinEventLog]
interval=60
evt_resolve_ad_obj = 0
evt_dc_name=
evt_dns_name=

[WinNetMon]
interval=60

[WinPrintMon]
interval=60

[WinRegMon]
interval=60
baseline=0

[perfmon]
interval=300

[powershell]
interval=60

[powershell2]
interval=60

[helge]

See also https://answers.splunk.com/answers/444108/splunk-sub-processes-startstop-every-minute-splunk.html

[mattymo]

6.5.2 fresh 32 bit win10 install, no inputs enabled during install, no windows TA, default stanzas enable the inputs, and process explorer says they spin up and die. you literally have to carve out it's guts to get them to never run. local disable, doesn't seem to work. will test again on disabling on local for 6.5.2, if it doesn't work, I'll submit an ER.

One workaround ive seen is setting interval to -1 so it they only run once..kind of meh as a solution, but I'm more comfortable with that, then telling you to lobotomize your forwarder.

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = n00b-noah-01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60

[ddrillic]

How do you submit an ER?

[mattymo]

as a client, you can submit it through the support portal. (P4 case severity)

[gjanders]

Have you tried (in a command window open as administrator):

splunk btool inputs list  --debug

That should tell you which file is enabling the inputs, perhaps there is another inputs.conf file enabling these inputs that you are not noticing...

[lrhazi]

I did, not sure I can identify the ones responsible for these programs..
The ones I suspected are the ones I tried to disable, see my original post, but to no avail.

$ cat   /cygdrive/d/LogServer/foo.txt | grep '\['
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [MonitorNoHandle]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [SSL]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinEventLog]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Application]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://Security]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf   [WinEventLog://System]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinRegMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [admon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [batch://C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\...stash_new]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [blacklist:C:\Program Files\SplunkUniversalForwarder\etc\auth]
C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf                          [default]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [fschange:C:\Program Files\SplunkUniversalForwarder\etc]
C:\Program Files\SplunkUniversalForwarder\etc\apps\splunk_httpinput\default\inputs.conf         [http]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\license_usage_summary.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [perfmon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [powershell2]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [script://C:\Program Files\SplunkUniversalForwarder\bin\scripts\splunk-wmi.path]
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\default\inputs.conf [splunktcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [tcp]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [udp]

[gjanders]

Under:
[WinNetMon]
[WinPrintMon]
[WinRegMon]

Do you see the disabled = 1 ?

[lrhazi]

You're right, I don't see that! it ignored my input stanzas in :

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf

for example:

C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinNetMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        [WinPrintMon]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        baseline = 0
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        evt_resolve_ad_obj = 0
host = idmsrv01
index = default
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf                        interval = 60

[gjanders]

Oh ok so something has put that into the system\default entries, the system\local entries could override it. I'm guessing this was an older forwarder installation that included the windows TA?

Perhaps you could uninstall/re-install the forwarder and just re-deploy the Windows TA (or automatically if your already sending it down from a deployment server).

[lrhazi]

Thanks. I will try the fresh reinstall idea. without adding any app at all.

[lrhazi]

An uninstall/reinstall seems to fix the issue!
Now, I added that TA app back and the issue still did not re-appear!!!
Very odd... Thank you all anyways 🙂

[lrhazi]

What's odd is that performing an uninstall then fresh install, and problem is gone.

Add Splunk_TA_windows app, restart agent, and problem appears (commands execute every minute)

Remove Splunk_TA_windows app, restart Splunk agent, and issue still continues!! (commands continue to execute every minute)!!!

[gjanders]

How are you installing Splunk TA windows? If your just dropping in the file from the deployment server removing the app and restarting should emove all related schedules/scripts.

[lrhazi]

I simply drop the TA folder into the /etc/apps folder. To uninstall I just remove that folder.

To remove the TA app, do I need to remove other things from other places? besides the app's subfolder?

Thanks,
Mohamed.

[gjanders]

No, that should work! As long as you restart the forwarder afterward.

[mattymo]

in my latest experience the forwarder needed a lobotomy to get it to stop. going to test with 6.5.2 which ships with the traditional inputs disabled, but they are present despite the windows TA...

[mattymo]

what version of the forwarder are you on? The newer versions don't install windows monitors by default more, IIRC. Checking...