I have ~ 800 windows servers getting their configs from a deployment server. Often when i roll a new version of the perf app out, and splunk restarts, perfmon targets stop logging completely from some hosts. Splunk UF version 4.3-6.0 running on Windows 2003-2008.
Why? Is there a known workaround?
EDIT: Non-perfmon targets continue to work normally on these servers
EDIT2:
inputs.conf
[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0
perfmon.conf
[PERFMON:CPU]
counters = % Processor Time
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perf
After splunk 5 there is no perfmon.conf. While upgrading some gets migrated to inputs.conf. sometimes if the migration doesn't happen properly then they don't forward. The configurations are case sensitive.
Replace like below.
[perfmon://CPU]
counters = % Processor Time
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perf
Thanks,
L
After splunk 5 there is no perfmon.conf. While upgrading some gets migrated to inputs.conf. sometimes if the migration doesn't happen properly then they don't forward. The configurations are case sensitive.
Replace like below.
[perfmon://CPU]
counters = % Processor Time
disabled = 0
instances = _Total
interval = 60
object = Processor
index = perf
Thanks,
L
Thank you! I didn't grok what you were saying in the first comment. 🙂
They all have identical settings. Let's just focus on the 6.0 SUF servers. Some work and some don't. They have identical configs. Reboots don't cure the problem.
they have different syntax , if not migrated properly they wont forward the data.
include perfmon in the inputs.conf file and restart