I wanted to offer and update. After making the change and performing a restart of the forwarder service memory still climbed pretty quickly to near what it was prior. I then restarted the client servers i running the script on and now 7 days not only as it held between 30-50% i even saw a spike to 76% at one point then it reclaimed 12 hrs later. That at least tells me most likely adding system.gc corrects the issue but requires a restart of the system. I will continue to watch mine for another week or so but consider the matter closed. Thank you ... View more

Good morning,  We did see some decrease in memory however initially i was not sure if the GC need to be inside or outside the foreach loop. Originally i had If (Get-WmiObject -Class Win32_ServerFeature -ComputerName $env:computername | Where-Object {$_.name -like "Web Server (IIS)"}){ Import-Module WebAdministration $ApplicationPools = Get-ChildItem IIS:\AppPools; Foreach ($ApplicationPool in $ApplicationPools){ $ApplicationPoolName = $ApplicationPool.Name; $ApplicationPoolState = $ApplicationPool.State; If ($ApplicationPool.processModel.identityType -eq 'SpecificUser'){ $UserIdentity = $ApplicationPool.processModel.UserName; } else { $UserIdentity = $ApplicationPool.processModel.identityType; } Write-Output " ApplicationPoolName=`"$ApplicationPoolName`" ApplicationPoolState=`"$ApplicationPoolState`" UserIdentity=`"$UserIdentity`" "; } Remove-Module WebAdministration } [System.gc]::Collect() but memory slowly creeped upward so altered the script to  If (Get-WmiObject -Class Win32_ServerFeature -ComputerName $env:computername | Where-Object {$_.name -like "Web Server (IIS)"}){ Import-Module WebAdministration $ApplicationPools = Get-ChildItem IIS:\AppPools; Foreach ($ApplicationPool in $ApplicationPools){ $ApplicationPoolName = $ApplicationPool.Name; $ApplicationPoolState = $ApplicationPool.State; If ($ApplicationPool.processModel.identityType -eq 'SpecificUser'){ $UserIdentity = $ApplicationPool.processModel.UserName; } else { $UserIdentity = $ApplicationPool.processModel.identityType; } Write-Output " ApplicationPoolName=`"$ApplicationPoolName`" ApplicationPoolState=`"$ApplicationPoolState`" UserIdentity=`"$UserIdentity`" "; [System.gc]::Collect() } Remove-Module WebAdministration } watching this currently to evaluate. Also testing the following variants. If (Get-WmiObject -Class Win32_ServerFeature -ComputerName $env:computername | Where-Object {$_.name -like "Web Server (IIS)"}){ $ApplicationPools = Get-WebConfiguration -Filter '/system.applicationHost/applicationPools/add' foreach ($ApplicationPool in $ApplicationPools){ $ApplicationPoolName = $ApplicationPool.Name; $ApplicationPoolState = $ApplicationPool.State; If ($ApplicationPool.processModel.identityType -eq 'SpecificUser'){ $UserIdentity = $ApplicationPool.processModel.UserName; } else { $UserIdentity = $ApplicationPool.processModel.identityType; } Write-Output " ApplicationPoolName: $ApplicationPoolName ApplicationPoolState: $ApplicationPoolState UserIdentity: $UserIdentity "; [System.gc]::Collect() } Remove-Module WebAdministration } So watching it a bit longer. Unfortunately this is a slow memory creep 9 days or so before it normally reaches its peek. ... View more

Thank you Dmarling,  We are adding the line to our script and will be testing, monitoring the memory this week. For us normally it takes approximately 9 days to get memory to the 80-90% range. We really appreciate your help and reply. Thank you again ... View more

What script, cmdlet and output did you end up using? ... View more

the script works, however it has a memory leak on the servers. That was the issue which opened this as over time memory is slowly eaten. THe script returns the following to splunk 1/10/22 9:05:01.000 AM   ApplicationPoolName="Sites" ApplicationPoolState="Started" UserIdentity="domain\SvcUser" ... View more

You are correct Splunk cloud, unfortunately i am only a mere power user not admin. LoL But can run it past the admin to see if he will. I originally had the search, saved as a report then scheduled it to run daily because one of our team members like it delivered to his in box instead of the dashboard. Sadly though you confirmed what i was afraid of about the coloring. I had read send it as pdf could save the color but I was hoping to just have it inserted. I appreciate your help even though it only confirmed what i was hoping not to do.   Have a wonderful day. ... View more

Thank you, as we are using Splunk web i am not sure that option could work. the query is. index=Index sourcetype=WinHostMon source="service" host="*" DisplayName="Bits*" | rename DisplayName AS ServiceName | rename State AS Status | eval host = lower(host) | lookup ourhosts_env host OUTPUTNEW Environment | rename host as Host | eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | eval CurrentStatus = case(StartMode == "Disabled" AND Status == "Stopped", "Disabled", StartMode == "Auto" AND Status == "Running", "Success", StartMode == "Auto" AND Status == "Stopped", "Failure", StartMode == "Auto" AND Status == "Stopped", "Failure") | stats latest(Time) as Time latest(Status) as Status latest(StartMode) as StartMode by Host ServiceName Environment CurrentStatus | table Time Environment Host Status StartMode CurrentStatus When i run the search, or the report the colored cells show red, yellow, green. The email just has plain table no color. ... View more