Deployment Architecture

splunk-regmon Running in UniversalForwarder when not monitoring the Registry

kenoski
Path Finder

Hi,

We are currently not monitoring for Registry items on our UniversalForwarder, but the indexer that is receiving windows events from the forwarder is telling us that the splunk-regmon executable is running, I am guessing its default number of times per hour.

How is this disabled so that regmon is not started when we do not monitor for these items.

Thx.

0 Karma
1 Solution

jimodonald
Contributor

I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.

View solution in original post

0 Karma

jimodonald
Contributor

I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.

0 Karma

kenoski
Path Finder

I'll check back with support to get confirmation if it was fixed in either of the newer versions.

thx.

0 Karma

kenoski
Path Finder

I was told by support that SPL-92479 was fixed as of Jan 23, 2015.

0 Karma

jimodonald
Contributor

What version of the UF was released on or after that date?

0 Karma

kenoski
Path Finder

Splunk just released 6.2.3 as of May 1st, and 6.2.2 was some time after Jan 23rd, I believe.

I haven't installed the UF yet to verify if its fixed there.

However, I don't know if this is my problem because I am also seeing this in my indexer with both 6.2.1 and 6.2.3.

I'm seeing this with at least the Registry monitor, host print monitor, and network monitor.

0 Karma

jimodonald
Contributor

What version of UF are you running?

0 Karma

kenoski
Path Finder

We are using Splunk 6.2.1 on both Indexers and UF. Both are showing regmon running every minute.

The indexer is even showing the default Registry monitoring items as disabled.

Thx for any help.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...