How to fix perfmon errors "Object specified...in conf file is not valid"?

[dmhlakaza]

how to fix this error:
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'Processor' in stanza - 'CPU' in conf file is not valid.
09-03-2014 10:25:59.516 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'LogicalDisk' in stanza - 'Logical Disk' in conf file is not valid.
09-03-2014 10:25:59.516 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'Memory' in stanza - 'Memory' in conf file is not valid.
09-03-2014 10:25:59.516 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'Network Interface' in stanza - 'Network' in conf file is not valid.
09-03-2014 10:25:59.516 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'Process' in stanza - 'Processes' in conf file is not valid.
09-03-2014 10:25:59.516 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index gdf" splunk-perfmon - The object specified - 'System' in stanza - 'System' in conf file is not valid.

[linu1988 · Accepted solution]

More over did you check if the perfmon counter are available in your system? SOmetimes they get corrupt and are not accessible

[linu1988]

Needs to be marked as answered then 🙂

[dmhlakaza]

I just checked the perfmon counter and yes indeed they were corrupt, I ran the following commands to fix it
Rebuilding the counters:
cd c:\windows\system32
lodctr /R
cd c:\windows\sysWOW64
lodctr /R

Resyncing the counters with Windows Management Instrumentation (WMI):
WINMGMT.EXE /RESYNCPERF

Stop and restart the Performance Logs and Alerts service.
Stop and restart the Windows Management Instrumentation service.
Thank you very much

[linu1988]

Hello,
It suggests the perfmon configuration in inputs.conf file is wrong, Could you post your stanzas?

Thanks

[linu1988]

Still this should be like this PERFMON -> Perfmon

[Perfmon:CPU]
counters = % Processor Time;% Privileged Time
disabled = 0
instances = _Total
interval = 120
object = Processor
index = temp_index

restart the forwarder service, lets see what happens

[dmhlakaza]

thanks, but I am still using v4.3.6, I am planning to upgrade soon

[linu1988]

Depends which version of splunk you are using. Please use the below in inputs.conf in v5+ splunk forwarders

[perfmon://CPU Load]
counters = % Processor Time;% Privileged Time
disabled = 0
instances = _Total
interval = 120
object = Processor
index = temp_index

Remember the stanza definition is case sensitive.

[dmhlakaza]

continued

[PERFMON:Processes]
counters = ID Process
disabled = 0
instances = *
interval = 900
object = Process

[PERFMON:Network]
counters = Bytes Received/sec;Bytes Sent/sec;Current Bandwidth
disabled = 0
instances = *
interval = 300
object = Network Interface

[PERFMON:System]
counters = System Up Time
disabled = 0
instances = *
interval = 3600
object = System

[dmhlakaza]

these are my stanzas and they working on other servers:

[PERFMON:CPU]
counters = % Privileged Time;% Processor Time;% User Time;DPCs Queued/sec
disabled = 0
instances = *
interval = 300
object = Processor

[PERFMON:Logical Disk]
counters = % Free Space;Current Disk Queue Length;Disk Read Bytes/sec;Disk Write Bytes/sec
disabled = 0
instances = *
interval = 900
object = LogicalDisk

[PERFMON:Memory]
counters = % Committed Bytes In Use;Page Reads/sec;Page Writes/sec
disabled = 0
instances = *
interval = 300
object = Memory