Ok, after having double checked, the Linux nmon priority feature works as expected,with: Linux_embedded_nmon_priority="0" In local/nmon.conf, the nmon_helper.sh will use any nmon binary available in PATH before trying to use embedded binaries. I have updated the documentation which was not up to date, the default configuration sets priority to embedded binaries since v1.6.07: http://nmonsplunk.wikidot.com/documentation:userguide:configure:collection:priority In your case, the presence of the other nmon process is not related to the TA-nmon (options sent to the nmon exe are not the one used by the TA-nmon) Still i do know what was causing cores in your deployment... ... View more

Is this still applicable in 6.x? Looking to manage deployment clients and will need to support several thousand on each DS. ... View more

There's a good chance this is caused by your data collection timing out, and having the field match on partial context in the timeout error message. For more detail, see the response to your other posted question:      http://splunk-base.splunk.com/answers/29021/ossec_agent_statuspy-v-on-local-server-timeout-exceeded-error ... View more

The timeout was increased to 30 seconds in version 1.1.89. ... View more

Its not a BUG! Just figured it out! It's because the agent count never had been past 000. Once you had an agent, it works great! ... View more