Need your help to configure UF in my windows 64 bit machine , have configure UF and getting WMI data but i am unable to get LocalProcesses, have created wmi.conf and following are the configuration
[WMI:LocalPhysicalDisk]
interval = 60
wql = select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
index = default
disabled = 0
[WMI:LocalProcesses]
interval = 60
wql = select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process
index = default
disabled = 0
[WMI:Memory]
interval = 60
wql = select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory
index = default
disabled = 0
[WMI:CPUTime]
interval = 60
wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total"
index = default
disabled = 0
I am getting every thing except "WMI:LocalProcesses" , i dont understand the cause of this , it is b'cos of i am 64bit machine if so, what configuration have to make to get the data.
Thanks in advance.
When I use the WMI collector below: I get this info"Microsoft Windows Server 2008 R2 Enterprise, Win32_ComputerSystem, 64-bit, 7601"
[WMI:LocalOSInfo]
interval = 21600
disabled = 0
server = localhost
wql = select * from Win32_OperatingSystem
I am collecting the "WMI:LocalProcesses" info on only one process from all my 2008 64bit systems.
Try collecting the "LocalOSInfo" like this (select * from Win32_OperatingSystem
) and see what version your running
If you get the same info I get then try collecting from one process only like this(SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process WHERE Name = "splunkd")
Hope this helps