Perfmon:Memory no data even though local performance monitor displaying memory stats for Windows 2003 Server

[rainhailrob]

I have a Windows 2003 Server that is able to report memory stats when running the Windows performance monitor locally on the server. Unfortunately I do not see any data in Splunk for memory for this particular system. All of the other Windows 2003 Servers are displaying memory stats.

[linu1988]

go to perfmon, check if the counters are present or not. Write the exact names with spaces, or check with my earlier comment restoring the perfmon counters if missing

[lukejadamec]

Based on the error, this post,

http://answers.splunk.com/answers/25644/perfmon-no-longer-working

and some google...

Try verifying that the counter is enabled, and

%Committed Bytes In Use

instead of

% Committed Bytes In Use

[rainhailrob]

splunkd.log
ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\% Committed Bytes In Use' error 0xc0000bb9\n

ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\Available MBytes' error 0xc0000bb9\n

ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\Committed Bytes' error 0xc0000bb9\n

[lukejadamec]

In case you have not checked, are there errors for this input in the splunkd logs?

[rainhailrob]

BenjaminWyatt:

inputs.conf snippet...

Memory

[perfmon://Memory]
counters = % Committed Bytes In Use;Available MBytes;Committed Bytes
disabled = 0
interval = 300
object = Memory
_TCP_ROUTING = mysplunkindexers
index = myindexname

[linu1988]

Please check if the memory object is mentioned properly. Or it may also be possible the perfmon is corrupt and it is not present for monitoring. Refresh your performance counters.

[BenjaminWyatt]

Do you have Splunk configured to monitor your Memory perfmon counter in inputs.conf or perfmon.conf (depending on your Splunk version)? If so, can you post the relevant configuration stanza?