Getting Data In

Perfmon not sending data

stnorbert
Explorer

Hi guys, little help with this amazing program.

I recently installed the universal forwarder onto two 32 bit windows server machines and it forwarded all the data i needed. since then I've expanded onto two windows server 64 bit machines. these are sending all other information aside from Perfmon data. i've done a little research and a little thinking and have tried :

http://docs.splunk.com/Documentation/Splunk/4.2.3/ReleaseNotes/Workaroundtoadd64-bitWindowsperfmonin...

I restarted both splunk on the server and the local splunk service after this this has not worked 😞

all help much appreciated.

Tags (2)

stnorbert
Explorer

Since last time i have tried Re-installing splunk (had some IP Addressing issues which have been resolved)

Changed the "object" value of Processor to Processor Information as provided helpfully here:

http://splunk-base.splunk.com/answers/28012/unable-to-pull-perfmon-counter-for-processor-time-window...

Since then the other errors have appeared

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - PerfmonHelper::enumObjectByNameEx: PdhEnumObjectItems failed for object - 'Memory' with error (0xc0000bb8): The specified object was not found on the computer.
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Unable to add counter '\Processor Information()\% Processor Time' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk(
)\Free Megabytes' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk(*)\% Free Space' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -

Then after the initial Errors it continues with the below indefinetly.

09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick

My Perfmon.conf is as follows:

[PERFMON:CPU Load]
counters = % Processor Time;% User Time
disabled = 0
instances = _Total
interval = 10
object = Processor Information

[PERFMON:Available Memory]
counters = Available Bytes
disabled = 0
interval = 10
object = Memory

[PERFMON:Free Disk Space]
counters = Free Megabytes;% Free Space
disabled = 0
instances = _Total
interval = 10
object = LogicalDisk

[PERFMON:Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
disabled = 0
instances = *
interval = 10
object = Network Interface

stnorbert
Explorer

Since the first time i asked this question a few more things i have tried:
Comparing the .conf (between the working 32-bit and non working 64-bit) files for the Universal Forwarder App and for the System, all of the .conf files where changed or the same.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Real-timeWindowsperformancemonitoring
Under: Configure local Windows performance monitoring with Splunk Web
The places this walktrhough point to i cannot find on my version of splunk (4.2.3)

splunkd.log is giving me :

09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:45.702 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
09-26-2011 19:57:48.286 +0800 ERROR TcpOutputProc - Can't find or illegal IP address or Name: pegasus
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:57.703 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...