- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Perfmon:Memory no data even though local performan...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfmon:Memory no data even though local performance monitor displaying memory stats for Windows 2003 Server
I have a Windows 2003 Server that is able to report memory stats when running the Windows performance monitor locally on the server. Unfortunately I do not see any data in Splunk for memory for this particular system. All of the other Windows 2003 Servers are displaying memory stats.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
go to perfmon, check if the counters are present or not. Write the exact names with spaces, or check with my earlier comment restoring the perfmon counters if missing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on the error, this post,
http://answers.splunk.com/answers/25644/perfmon-no-longer-working
and some google...
Try verifying that the counter is enabled, and
%Committed Bytes In Use
instead of
% Committed Bytes In Use
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunkd.log
ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\% Committed Bytes In Use' error 0xc0000bb9\n
ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\Available MBytes' error 0xc0000bb9\n
ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - Unable to add counter '\Memory(*)\Committed Bytes' error 0xc0000bb9\n
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In case you have not checked, are there errors for this input in the splunkd logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BenjaminWyatt:
inputs.conf snippet...
Memory
[perfmon://Memory]
counters = % Committed Bytes In Use;Available MBytes;Committed Bytes
disabled = 0
interval = 300
object = Memory
_TCP_ROUTING = mysplunkindexers
index = myindexname
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please check if the memory object is mentioned properly. Or it may also be possible the perfmon is corrupt and it is not present for monitoring. Refresh your performance counters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have Splunk configured to monitor your Memory perfmon counter in inputs.conf or perfmon.conf (depending on your Splunk version)? If so, can you post the relevant configuration stanza?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
