Getting Data In

Remote Eventlog with wmi generates high CPU

CerielTjuh
Path Finder

Hi there,

I know that the best practice for high usage systems is a Splunk Forwarder but due to easy management my system administrators don't want any Splunk software on the machines and want to use WMI polling.

WMIprvse.exe takes up 20% of CPU on my Exchange server as soon as i turn on the Remote Eventlog polling. Is there a way to limit this or change this behaviour?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

View solution in original post

0 Karma

atx876
Explorer

We are trying to do the same, can you provide us some documentation on how you setup WMI? We are trying to collect from multiple windows clients joined to different DC. I cannot seem to find how i can pass various passwords via the WMI scripted inputs.

0 Karma

CerielTjuh
Path Finder

I have found an answer to all my questions.
Splunk generates a lot of CPU time on machines when polling with WMI.
This is not an issue at all, if a user or the system requires CPU time, the WMI service is suppressed and releases the CPU. When the process finishes and WMI gets CPU time all the eventlogs are collected and send to the central Splunk server.

You can check this out your self by running CPU Burn-in on the target machine (twice for a dual core machine).

0 Karma

CerielTjuh
Path Finder

As extra information:

The high CPU is caused by the Security Eventlog, my thoughts are to filter the events when querying for them, is that possible?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...