Why my windows Server 2008 doesn't send performance ?

[Afef]

Hello,

I installed a universal forwarder (6.2.2) on two servers Active directory (windows 2008), I configured inputs.conf to send performance data. The problem is : i received only DNS perfmornce (perfmon DNS and perfmon NTFS), i didnt receive system performance (memory, processor..).

Could you help me please ?

Regards

[martin_mueller]

Copying those CPU settings into my German Windows 7 works.

[Afef]

yes it works for me with my windows 7, and other windows server 2008 R2, but it didn't work with 2 windows server 2008 ( active directory server). I didn't understand why.

[linu1988]

Hi,
Best way to troubleshoot is to check the splunkd.log files and see if you are making any mistake on the input stanza. Did u check the permission on the input files? they don't forward if splunk is not able to read them. so go to security tab and see who all are having the permission. Then give the necessary permissions.

Thanks,
L

[Afef]

Hi, yes i chcked the splunkd.log and i didn't find errors. I also checked the permission on the inputs files, and splunk is able to read them. I can't find the source of the problem.

[martin_mueller]

You could post your inputs.conf settings to increase your chances of finding someone with a solution.

[Afef]

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 0
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

[Afef]

Memory

[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s)
disabled = 0
interval = 10
object = Memory
useEnglishOnly=true
index = perfmon

[Afef]

Network

[perfmon://Network]
counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size

disabled = 0
instances = *
interval = 10
object = Network Interface
useEnglishOnly=true
index = perfmon

[Afef]

any help please ?

[martin_mueller]

Are they possibly logging perfmon data in a different language?

[Afef]

In inputs.conf there is : UseEnglishOnly=true