WMI data index question

[dbarbon]

Hi I want to investigate about not responding application. 20 PC has this application installed but only 3 or 4 of them got blocking every night at 4:00 am.
No logs are generated, so I want to use WMI, but what counters I have to index?
Thanks in advance!

[dbarbon]

Vladimir, thanks for your response.
Now I have to implement Splunk on the customer network and start searching!

[Vladimir]

I think it depends on what actually you want. I would start with standard windows application log and maybe processes info (wql = SELECT * FROM Win32_PerfFormattedData_PerfProc_Process WHERE Name LIKE "YourApplicationName%")