Remote Eventlog with wmi generates high CPU

[CerielTjuh]

Hi there,

I know that the best practice for high usage systems is a Splunk Forwarder but due to easy management my system administrators don't want any Splunk software on the machines and want to use WMI polling.

WMIprvse.exe takes up 20% of CPU on my Exchange server as soon as i turn on the Remote Eventlog polling. Is there a way to limit this or change this behaviour?

Thanks in advance!

[atx876]

We are trying to do the same, can you provide us some documentation on how you setup WMI? We are trying to collect from multiple windows clients joined to different DC. I cannot seem to find how i can pass various passwords via the WMI scripted inputs.

[CerielTjuh · Accepted solution]

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

[CerielTjuh]

As extra information:

The high CPU is caused by the Security Eventlog, my thoughts are to filter the events when querying for them, is that possible?