Retrive memory usage of processes

[dsmith5]

Trying to setup Universal Forwarder to send memory information for all processes/a particular process. Could someone point me in the direction of the correct file to configure and ideally the config lines as well.

An example would be that I wish to receive the memory usage of iexplore.exe from a remote Windows system.

The Splunk server with Widnows Management app shows only the memory usage of the processes on itself.

Thank you,

Darren

[bmacias84]

I am guessing you are not using a universal forwarder. If not, WMI will have to be enabled on your wintel device, ports allowed through the local and network firewalls, and from the WMI Control security is set to Enabled.

http://www.poweradmin.com/HELP/ENABLEWMI.ASPX
http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Wmiconf
http://msdn.microsoft.com/en-us/library/windows/desktop/aa394277(v=vs.85).aspx

configure the wmi.conf

[WMI:ProcessMemory]
interval = 60
#Below are the IPs of the remote systems
server = 10.1.1.25, 10.1.1.29, 10.1.1.28
#Working set is the set of memory pages touched recently by the process (taskmanager)
wql = select WorkingSet, Name from Win32_PerfFormattedData_PerfProc_Process