WMI vs Perfmon: No Local Processes?

[adamw]

I noticed while comparing the default configs for WMI and Perfmon that there's a LocalProcesses query in WMI that lacks a corresponding entry in Perfmon. It seems unique in this regard and I'm wondering if there's a reason it's not there.

Is there something I'm missing?

[dokian]

I was hanging out for an answer to this question. Thanks for the response!

I needed to make a slight change to get it working though:

[PERFMON:Process Monitor]
counters = ID Process;% User Time
disabled = 0
instances = *
interval = 10
object = Process

The values for counters and object needed to be swapped.

[fervin]

Are you noticing that only processes run by SYSTEM show up? We are noticing this in our environment.

[proctorgeorge]

Perfmon does usually have a Process Query, you would have to add the counter for it in perfmon.conf. The entry would look something like this:

[PERFMON:Process Monitor]
counters = ID Process;% User Time
disabled = 0
instances = *
interval = 10
object = Process
index = some_Index

The instances field could be * (all processes) like mine or a specific process, ex. notepad, splunkd, or explorer. The Counters field would be aspects you want to monitor of the process, PID, Memory Usage, CPU Usage, etc.

EDIT: Switched the counters and object, got messed up in translation. It is correct now, or look at Dokian's, Thx Dokian!

EDITx2: Clarity/Grammar