Getting Data In

How to collect perfmon data on .NET counters?

anewell
Path Finder

I am attempting to collect perfmon counters to track garbage collection in a .NET application. I can create the counter locally in the Windows perfmon GUI, so I believe the data ought to be exposed to the Splunk perfmon modular input. However, the inputs.conf stanza I've created does not work, and returns no errors.

[perfmon://NETGarbageCollection]
counters = NumberGen2Collections
disabled = false
instances = *
interval = 60
object = Win32_PerfFormattedData_NETFramework_NETCLRMemory
index = test

I have also tried running a WMI query directly from the splunk-wmi.exe helper executable (a technique I've used successfully before)

PS C:\Program Files\SplunkUniversalForwarder\bin> & .\splunk-wmi.exe -wql "SELECT * FROM Win32_PerfFormattedData_NETFram
ework_NETCLRMemory"

Clean shutdown completed.

PS C:\Program Files\SplunkUniversalForwarder\bin> & .\splunk-wmi.exe -wql "SELECT NumberGen2Collections FROM Win32_PerfF
ormattedData_NETFramework_NETCLRMemory"

Clean shutdown completed.

My developers are hoping to use the counter information to debug a problem in our production software, and so there is considerable interest in getting this working.

I am collecting perfmon on a Universal Forwarder which is otherwise working as expected. Indexer and forwarder are both running Splunk 6.0.3, OS is Windows server 2012, .NET is 4.5. I've been taking my perfmon counter names and object paths from this reference.

Thanks!

0 Karma
1 Solution

anewell
Path Finder

Found a workaround, in the form of a scripted input run on the forwarder. (The regex is to select IIS-related counters, which happen to be what I'm after)

The script outputs a table of each IIS process and it's "# Gen 2 Collections" perfmon counter:

#! powershell
$gc2 = get-counter -Counter "\.NET CLR Memory(w3wp*)\# Gen 2 Collections"
[regex]$regex = 'w3wp(\#\d)?'
$arrCounterPath = $gc2.CounterSamples | %{ $regex.match($_.Path) } | %{$_.value}
$output = @{}
for ($i=0; $i -lt $gc2.CounterSamples.count; $i++) {
        $output.add($arrCounterPath[$i], $gc2.CounterSamples[$i].CookedValue)
    }

#  tabular output is fine for splunk; run through "multikv" search command.
write-output $output

View solution in original post

Goldbeed
Engager

This is what I used to ingest the data

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 10
object=.NET CLR Memory
useEnglishOnly=true,This is what I Used to gather the data into splunk.

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 5
object=.NET CLR Memory
useEnglishOnly=true,This is what I used to gather the content for splunk

[perfmon://.NET CLR Memory]
counters = % Time in GC
disabled = 0
instances = *
interval = 5
object=.NET CLR Memory
useEnglishOnly=true

anewell
Path Finder

Found a workaround, in the form of a scripted input run on the forwarder. (The regex is to select IIS-related counters, which happen to be what I'm after)

The script outputs a table of each IIS process and it's "# Gen 2 Collections" perfmon counter:

#! powershell
$gc2 = get-counter -Counter "\.NET CLR Memory(w3wp*)\# Gen 2 Collections"
[regex]$regex = 'w3wp(\#\d)?'
$arrCounterPath = $gc2.CounterSamples | %{ $regex.match($_.Path) } | %{$_.value}
$output = @{}
for ($i=0; $i -lt $gc2.CounterSamples.count; $i++) {
        $output.add($arrCounterPath[$i], $gc2.CounterSamples[$i].CookedValue)
    }

#  tabular output is fine for splunk; run through "multikv" search command.
write-output $output

anewell
Path Finder
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...