I noticed while comparing the default configs for WMI and Perfmon that there's a LocalProcesses query in WMI that lacks a corresponding entry in Perfmon. It seems unique in this regard and I'm wondering if there's a reason it's not there.
Is there something I'm missing?
I was hanging out for an answer to this question. Thanks for the response!
I needed to make a slight change to get it working though:
[PERFMON:Process Monitor] counters = ID Process;% User Time disabled = 0 instances = * interval = 10 object = Process
The values for
object needed to be swapped.
Perfmon does usually have a Process Query, you would have to add the counter for it in perfmon.conf. The entry would look something like this:
[PERFMON:Process Monitor] counters = ID Process;% User Time disabled = 0 instances = * interval = 10 object = Process index = some_Index
The instances field could be * (all processes) like mine or a specific process, ex. notepad, splunkd, or explorer. The Counters field would be aspects you want to monitor of the process, PID, Memory Usage, CPU Usage, etc.
EDIT: Switched the counters and object, got messed up in translation. It is correct now, or look at Dokian's, Thx Dokian!