Getting Data In

perfmon no longer working?

twinspop
Influencer

Installed via command line with:

msiexec /I splunk...msi /qn ALLUSERS=1 REBOOT=ReallySuppress AGREETOLICENSE=Yes RECEIVING_INDEXER="indexer:7900"

myapp/defaults/inputs.conf:

[monitor://C:\WINNT\system32\LogFiles\HTTPERR]
disabled = false
sourcetype = iishttperr
ignoreOlderThan = 3d

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = false

myapp/defaults/perfmon.conf:

[PERFMON:Web Stats]
counters = Total Connection Attempts;Total Method Requests;Total Bytes Sent
disabled = false
instances = _Total
interval = 300
object = Web Service

Splunkd.log says:

06-02-2011 15:25:15.893 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Web Service(*)\Total Connection Attempts'  error 0xc0000bb9
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" splunk-regmon - No enabled entries were found in the conf files.
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" Using logging configuration at C:\Program Files\SplunkUniversalForwarder\etc\log-cmdline.cfg.
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

I'm no perfmon expert, but that error is:
0xC0000BB9 (PDH_CSTATUS_NO_COUNTER) The specified counter could not be found.

So, I'd imagine that your "Total Connection Attempts" counter isn't valid or isn't enabled. Maybe "Attempts" should be "attempts" (based on a some Googling and a little faith)?

View solution in original post

mw
Splunk Employee
Splunk Employee

I'm no perfmon expert, but that error is:
0xC0000BB9 (PDH_CSTATUS_NO_COUNTER) The specified counter could not be found.

So, I'd imagine that your "Total Connection Attempts" counter isn't valid or isn't enabled. Maybe "Attempts" should be "attempts" (based on a some Googling and a little faith)?

twinspop
Influencer

I was chasing my tail here. Apparently nothing is being logged from this SUF any longer. I saw the lack of perfmon entries first, and that log entry and focused in on that. But no log entries from even the most basic text file are making it to the indexer. Back to the drawing board. Thanks for the help on spotting my bad perfmon entry.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...