Getting Data In

splunk-perfmon.exe won't start

rsantoso_splunk
Splunk Employee
Splunk Employee

The splunk-perfmon.exe process exits soon after start with no error being logged wither in the splunkd.log or in the windows event log.

There is error message in the event viewer:
Perflib 1008 error
(perfmon doesn’t open)

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

1) Open a CMD via run as admin

2) Rebuild performance counters, run commands:

C:\Windows\system32\lodctr.exe /R
C:\Windows\SysWOW64\lodctr.exe /R

3) Now re-register the computer´s performance libraries with the following:

C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF

After perform this, the repair the perfmon metrics are now coming in.

Reference:
https://www.admin-enclave.com/en/articles/windows/306-resolved-the-open-procedure-for-service-bits-i...

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

1) Open a CMD via run as admin

2) Rebuild performance counters, run commands:

C:\Windows\system32\lodctr.exe /R
C:\Windows\SysWOW64\lodctr.exe /R

3) Now re-register the computer´s performance libraries with the following:

C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF

After perform this, the repair the perfmon metrics are now coming in.

Reference:
https://www.admin-enclave.com/en/articles/windows/306-resolved-the-open-procedure-for-service-bits-i...

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...