I am using the universal forwarder on Windows Servers as I thought it would gather the needed information. However, it seems it only reports total disk space, _total, and not on the individual drives. Is there a way I can capture individual drives with perfmon or should I revert to WMI polling, which is a pain in our envrironment due to getting a service AD account?
If I have to switch to WMI polling is there any point in leaving the universal forwarder on the windows servers to collect information?
Any help would be appreciated.
I found out you need to enable the counter in perfmon in the perfmon.conf file in etc/system/local on the host. I added the following and I was able to get perfmon to work.
[PERFMON:FreeDiskSpace]
counters = Free Megabytes;% Free Space
disabled = 0
instances = *
interval = 10
object = LogicalDisk
This worked for me!
index=perfstats sourcetype=PerfmonMk* host=servername C | timechart avg("%_Free_Space") by host
dar104,
I tried what you suggested, and I am not seeing results by drive letter. Can you contact me to discuss? I'd like to know better what to expect.
I found out you need to enable the counter in perfmon in the perfmon.conf file in etc/system/local on the host. I added the following and I was able to get perfmon to work.
[PERFMON:FreeDiskSpace]
counters = Free Megabytes;% Free Space
disabled = 0
instances = *
interval = 10
object = LogicalDisk
Yes!
You can get the UF to do the polling for your, assuming it is running under an account with admin permissions. I used to use a VBS script to perform the WMI query locally and the results of the query would be forwarded onto the indexer, a nice simple way to achieve what you want.
All I was getting from the forwarder was total disk space % instead of individual drives. I think I figured out a solution. I am testing now. If it works I will put results here.
Thanks for the response.