Getting Data In

Remote Eventlog with wmi generates high CPU

CerielTjuh
Path Finder

Hi there,

I know that the best practice for high usage systems is a Splunk Forwarder but due to easy management my system administrators don't want any Splunk software on the machines and want to use WMI polling.

WMIprvse.exe takes up 20% of CPU on my Exchange server as soon as i turn on the Remote Eventlog polling. Is there a way to limit this or change this behaviour?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

View solution in original post

0 Karma

atx876
Explorer

We are trying to do the same, can you provide us some documentation on how you setup WMI? We are trying to collect from multiple windows clients joined to different DC. I cannot seem to find how i can pass various passwords via the WMI scripted inputs.

0 Karma

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

0 Karma

CerielTjuh
Path Finder

As extra information:

The high CPU is caused by the Security Eventlog, my thoughts are to filter the events when querying for them, is that possible?

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...