Perfmon and german umlaute

[RainerKnufinke]

Hi Folks,

I'm testing Splunk with the Template for Citrix XenApp. It works quite well after changing the powershell scripts and the inputs.conf.
In inputs.conf, I've translated the perfmon counter to german and changed the xml to match the new settings (i.e. Prozessorzeit_(%) - % Processor Time).

This worked for me, but unfortunately all counters with german umlauts (Logischer Datenträger vs. LogicalDisk or Prozessor-Warteschlangenlänge vs. Processor Queue Length) are ignored and sending no data to my indexer.

Is there any workaround for this behaviour?

BTW. I've tried to upgrade my installation to 6.2 but this didn't work because I'm getting the Error "Splunk Enterprise setup wizard ended prematurely" and my Splunk services are gone...

So actually I'm running 6.1.5 on my indexer and my forwarders.

Thanks in advance,
Rainer

[karakutu]

perfmon für german

Translation data are in this register key to find

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\00[X]

X= depend how much language you install on this machine.

[perfmon://Available Memory]
interval = 30
object = Arbeitsspeicher
counters =  Verfügbare Bytes; Seiten/s
instances = _Total
disabled = 0

[perfmon://CPU Load]
counters = Prozessorzeit (%);Benutzerzeit (%)
instances = _Total
interval = 10
object = Prozessor
useEnglishOnly = false

[perfmon://Free Disk Space]
counters = Verfügbare MB;Freier Speicherplatz (%)
instances = *
interval = 3600
object = Logischer Datenträger
useEnglishOnly = false

[perfmon://Network Interface]
counters = Empfangene Bytes/s;Übertragene Bytes/s
instances = *
interval = 10
object = Netzwerkschnittstelle
useEnglishOnly = false

[ahall_splunk]

Upgrade your forwarder to 6.2. (I saw the note that the wizard ended prematurely - you need to solve that!) then use the useEnglishOnly parameter as described here: http://blogs.splunk.com/2014/11/10/splunk-6-2-feature-overview-perfmon-delocalization/

Your alternative is not very pretty, but is described in this blog post: http://blogs.splunk.com/2013/06/17/windows-perfmon-and-internationalization/

[RainerKnufinke]

Hallo Christian,

I've never solved this problem because we don't use Splunk for now.

Gruß,
Rainer

[RainerKnufinke]

I'm going to use your second opinion - and exactly that's my problem.
This is one translation in my input.conf:

[perfmon://Memory]
interval = 30
object = Arbeitsspeicher
counters =  Verfügbare Bytes; Seiten/s
instances = *
index=xd_perfmon
disabled = 0
mode = multikv

The name of the counters I would like to monitor are (in english) Available Bytes; Pages/sec. In german it's called Verfügbare Bytes; Seiten/s. I'm getting data from "Seiten/s", because there's no umlaut, but i don't get data for "Verfügbare Bytes" because there is an umlaut and the SplunkForwarder seems to ignore this counter.

And I can't update my Splunk to 6.2 because of an error with installtion on german windows (sic!) as discussed here: http://answers.splunk.com/answers/177866/why-am-i-getting-splunk-enterprise-setup-wizard-en.html

Looks like I'm stucked until a newer version of Splunk gets released...

Thanks,

Rainer.

[christianpanizi]

Hello Rainer,

how do you solve to get all the missing data into Splunk with a German XenApp 6.5 German OS?

It seems that not every Perfmon Counter (ICA especially) works with the useEnglishOnly = true parameter.

Would it be possible for you to share the input.conf and the xml files?

Beste Grüße
Christian