Getting Data In

Why my windows Server 2008 doesn't send performance ?

Afef
Communicator

Hello,

I installed a universal forwarder (6.2.2) on two servers Active directory (windows 2008), I configured inputs.conf to send performance data. The problem is : i received only DNS perfmornce (perfmon DNS and perfmon NTFS), i didnt receive system performance (memory, processor..).

Could you help me please ?

Regards

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Copying those CPU settings into my German Windows 7 works.

0 Karma

Afef
Communicator

yes it works for me with my windows 7, and other windows server 2008 R2, but it didn't work with 2 windows server 2008 ( active directory server). I didn't understand why.

0 Karma

linu1988
Champion

Hi,
Best way to troubleshoot is to check the splunkd.log files and see if you are making any mistake on the input stanza. Did u check the permission on the input files? they don't forward if splunk is not able to read them. so go to security tab and see who all are having the permission. Then give the necessary permissions.

Thanks,
L

0 Karma

Afef
Communicator

Hi, yes i chcked the splunkd.log and i didn't find errors. I also checked the permission on the inputs files, and splunk is able to read them. I can't find the source of the problem.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could post your inputs.conf settings to increase your chances of finding someone with a solution.

0 Karma

Afef
Communicator

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 0
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma

Afef
Communicator

Memory

[perfmon://Memory]
counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s)
disabled = 0
interval = 10
object = Memory
useEnglishOnly=true
index = perfmon

0 Karma

Afef
Communicator

Network

[perfmon://Network]
counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size

disabled = 0
instances = *
interval = 10
object = Network Interface
useEnglishOnly=true
index = perfmon

0 Karma

Afef
Communicator

any help please ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are they possibly logging perfmon data in a different language?

0 Karma

Afef
Communicator

In inputs.conf there is : UseEnglishOnly=true

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...