Monitoring Splunk

Retrive memory usage of processes

New Member

Trying to setup Universal Forwarder to send memory information for all processes/a particular process. Could someone point me in the direction of the correct file to configure and ideally the config lines as well.

An example would be that I wish to receive the memory usage of iexplore.exe from a remote Windows system.

The Splunk server with Widnows Management app shows only the memory usage of the processes on itself.

Thank you,

Darren

Tags (1)
0 Karma

Champion

I am guessing you are not using a universal forwarder. If not, WMI will have to be enabled on your wintel device, ports allowed through the local and network firewalls, and from the WMI Control security is set to Enabled.

http://www.poweradmin.com/HELP/ENABLEWMI.ASPX
http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Wmiconf
http://msdn.microsoft.com/en-us/library/windows/desktop/aa394277(v=vs.85).aspx

configure the wmi.conf

[WMI:ProcessMemory]
interval = 60
#Below are the IPs of the remote systems
server = 10.1.1.25, 10.1.1.29, 10.1.1.28
#Working set is the set of memory pages touched recently by the process (taskmanager)
wql = select WorkingSet, Name from Win32_PerfFormattedData_PerfProc_Process
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!