- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- splunk-regmon Running in UniversalForwarder when n...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
We are currently not monitoring for Registry items on our UniversalForwarder, but the indexer that is receiving windows events from the forwarder is telling us that the splunk-regmon executable is running, I am guessing its default number of times per hour.
How is this disabled so that regmon is not started when we do not monitor for these items.
Thx.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll check back with support to get confirmation if it was fixed in either of the newer versions.
thx.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was told by support that SPL-92479 was fixed as of Jan 23, 2015.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of the UF was released on or after that date?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk just released 6.2.3 as of May 1st, and 6.2.2 was some time after Jan 23rd, I believe.
I haven't installed the UF yet to verify if its fixed there.
However, I don't know if this is my problem because I am also seeing this in my indexer with both 6.2.1 and 6.2.3.
I'm seeing this with at least the Registry monitor, host print monitor, and network monitor.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of UF are you running?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are using Splunk 6.2.1 on both Indexers and UF. Both are showing regmon running every minute.
The indexer is even showing the default Registry monitoring items as disabled.
Thx for any help.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
