Splunk causes repeated 'regmon' error on Windows 2000

[mctester]

I'm running version 4.0.8 splunk on Windows 2000 and it continually generates the following error.

Application popup: splunk-regmon.exe - Entry Point Not Found : The procedure entry point GetProcessImageFileNameW could no be located in the dynamic link library PSAPI.DLL.

Event ID: 26 Source: Application Popup

[gpburgett]

We had this same problem in a test we were running in a customer environment. This post was a lot of help. However, we disabled the input in the .conf file in the directory above with no result. We found that this input is enabled by default, so we had to edit the inputs.conf under $SPLUNK_HOME/etc/system/default and change the regmon stanza to disabled=1.

[gpburgett]

We just disabled the input in the conf file. You're right, it should layer the conf files and apply them according to splunk's precedence rules. We've had this problem before though, especially on Windows, where Splunk doesn't recognize conf file changes right away, even after restart. If we had waited or tried restarting a few more times it probably would have worked. But in that case when we changed the default file, the change was applied right away.

[mctester]

@gpgburgett: Did you disable the input in the ../local/inputs.conf file or simply remove it?

If you have the same stanza in multiple *.conf files, Splunk will layer them together and the settings in 'local' directories will be applied. If you had 'disabled=1' in a stanza with the same name in your ../local/inputs.conf, it should have killed the input for you. Strange that it didn't as this is basica functionality

[Mick · Accepted solution]

1) Windows 2000 is not a supported platform. Splunk will run mostly just fine on it, but there's no guarantee everything will work 100%. Microsoft have already withdrawn genearl support for this OS

2) The 'regmon' script in the Windows app is causing the error. If you disable the regmon input in $SPLUNK_HOME/etc/apps/windows/default/inputs.conf, it will cease to bother you.