Monitor memory performance for windows servers

[Pooja1]

Hi Team,

As we need to monitor memory by process for each windows hosts. As checked we couldn't find any processes for memory and instances value is showing only "0" but we are monitoring CPU by process for hosts, it contains instance field and we could see the processes name for CPU. We verified the inputs.conf stanzas everything is looking good need your help to configure this memory processes in the instances field.

Below are query used to populate CPU utilization by process
index=perfmon source="Perfmon:Process" counter="% Processor Time" instance!=_total instance!=idle | timechart limit=20 useother=f span=10m max(Value) as cputime by instance

So, we need same for memory utilization by process, and the counter = "% Committed Bytes In Use"

Thanks

[richgalloway]

This is the full set of process performance metrics that Splunk makes available to us.

% Processor Time, % User Time, % Privileged Time, Virtual Bytes Peak, Virtual Bytes, Page Faults/sec, Working Set Peak, Working Set, Page File Bytes Peak, Page File Bytes, Private Bytes, Thread Count, Priority Base, Elapsed Time, ID Process, Creating Process ID, Pool Paged Bytes, Pool Nonpaged Bytes, Handle Count, IO Read Operations/sec, IO Write Operations/sec, IO Data Operations/sec, IO Other Operations/sec, IO Read Bytes/sec, IO Write Bytes/sec, IO Data Bytes/sec, IO Other Bytes/sec, Working Set - Private

If you need other metrics, then perhaps there is third-party software available to collect the values and send them to Splunk.

[Pooja1]

Hi @richgalloway 

Can I know what kind of third party software should be available to collect the value and send it to Splunk?

Because I need "% Committed Bytes In Use" should be present in Perfmon :Process stanza , means  this "% Committed Bytes In Use" should be present in that counter list. so how can get this added?


Thanks

[richgalloway]

I don't know which third-party software offers that counter, if it's even available at all.

[Pooja1]

Hi @richgalloway,

Can we add "% Committed Bytes In Use" to Perfmon : Process??

Because I could see % Committed Byes In Use counter in Perfmon : Memory

I already tried to add that counter to Process source but no luck... is there any way to add??

Thanks

[richgalloway]

You can add anything you like to any perfmon stanza, but that doesn't mean it will work.  Only the documented (in Settings->Data input->Local performance monitoring) counters will work.

[Pooja1]

Hai @richgalloway ,

Using Splunk Web, I go to 'Data inputs' > 'Local performance monitoring' > Selected the input that are created
I see the following errors: Failed to fetch data: Admin handler 'win-perfmon-find-collection' not found.
This error is displayed for 'Available objects', 'Counters', 'Instances'

How can I resolve this error?

Thanks

[richgalloway]

Is the GUI running on a Windows machine?  If not, they I believe you will get an error like that since there are no local Windows performance inputs.  Instead, you'll need Remote Performance Monitoring.

[Pooja1]

Hi @richgalloway ,

I added only "% Processor Time" & "Working Set - Private" in Process source stanza it is taking all the other 28 counters.

Before counters = * > then it shows all the 28 counters. 
But, now I added only 2 counters ("% Processor Time" & "Working Set - Private") even though it is showing other counters also.

Please help me with this..

Thanks,
Pooja

[richgalloway]

I don't have the same experience.  When I select those two counters I get those two plus process_mem_used and process_cpu_used_percent, which appear to be duplicates of the selected counters.  I don't know how to help you from here.

[Pooja1]

Hi @richgalloway ,

Thank you for the support.

Thanks