Windows Universal Forwarder stopped logging perfmon: How can I restore this feature?

[twinspop]

I have ~ 800 windows servers getting their configs from a deployment server. Often when i roll a new version of the perf app out, and splunk restarts, perfmon targets stop logging completely from some hosts. Splunk UF version 4.3-6.0 running on Windows 2003-2008.

Why? Is there a known workaround?

EDIT: Non-perfmon targets continue to work normally on these servers

EDIT2:

inputs.conf

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0

perfmon.conf

[PERFMON:CPU]
counters = % Processor Time
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perf

[linu1988 · Accepted solution]

After splunk 5 there is no perfmon.conf. While upgrading some gets migrated to inputs.conf. sometimes if the migration doesn't happen properly then they don't forward. The configurations are case sensitive.

Replace like below.

[perfmon://CPU]
counters = % Processor Time
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perf

Thanks,
L

[twinspop]

Thank you! I didn't grok what you were saying in the first comment. 🙂

[twinspop]

They all have identical settings. Let's just focus on the 6.0 SUF servers. Some work and some don't. They have identical configs. Reboots don't cure the problem.

[linu1988]

they have different syntax , if not migrated properly they wont forward the data.

include perfmon in the inputs.conf file and restart