Unable to pull Perfmon Counter for %Processor Time Windows 2003 32-bit

[larry_lind]

Has anyone seen the errors below and know how to correct? This same perfmon.conf is applied to both Windows 2008 64-bit (working) and Windows 2003 32-bit (% Processor Time not working). The other counters are working just fine on both Windows 2008 and 2003. Running Splunk 4.2.2.

**ERRORS in splunkd.log**:  
07-22-2011 15:06:47.510 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Processor Information(*)\% Processor Time'  error 0xc0000bb8

07-22-2011 16:30:14.057 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick

**perfmon.conf**  
[Perfmon:LocalPhysicalDisk]  
interval = 60  
object = PhysicalDisk  
counters = % Disk Read Time; % Disk Write Time; % Disk Time; Current Disk Queue Length  
instances = _Total  
disabled = 0  
index = ems  

[Perfmon:LocalMainMemory]  
interval = 60  
object = Memory  
counters = % Committed Bytes In Use  
disabled = 0  
index = ems  

[Perfmon:Processor]  
interval = 60  
object = Processor Information  
counters = % Processor Time  
instances = _Total  
disabled = 0  
index = ems

[larry_lind]

I found the issue. It was the Perfmon Counter Object that changed between 2003 and 2008.

Windows 2003:

Object = Process

Windows 2008:

Object = Process Information

All is working now.

[neilamoran]

I'm curious - I'm also seeing lots of the "Counter list is empty" error message, and also having a problem with collecting % Processor Time for the _Total instance - all my instances are returned regardless of which ones I specify in perfmon.conf.

I am also running UF 4.2.2 on 64bit Windows 2003 R2 and 4.2.2 on the Indexer (Windows 2008 R2). Have also posted this question - http://splunk-base.splunk.com/answers/27989/specific-perfmon-instance-collection-problem.

Have you seen similar behaviour in your installation? Or are you just getting the _Total instance as expected?

[neilamoran]

Are you sure the Processor Information perfmon object exists in Windows 2003? I thought that was a new one....