Has anyone seen the errors below and know how to correct? This same perfmon.conf is applied to both Windows 2008 64-bit (working) and Windows 2003 32-bit (% Processor Time not working). The other counters are working just fine on both Windows 2008 and 2003. Running Splunk 4.2.2.
**ERRORS in splunkd.log**:
07-22-2011 15:06:47.510 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Processor Information(*)\% Processor Time' error 0xc0000bb8
07-22-2011 16:30:14.057 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
**perfmon.conf**
[Perfmon:LocalPhysicalDisk]
interval = 60
object = PhysicalDisk
counters = % Disk Read Time; % Disk Write Time; % Disk Time; Current Disk Queue Length
instances = _Total
disabled = 0
index = ems
[Perfmon:LocalMainMemory]
interval = 60
object = Memory
counters = % Committed Bytes In Use
disabled = 0
index = ems
[Perfmon:Processor]
interval = 60
object = Processor Information
counters = % Processor Time
instances = _Total
disabled = 0
index = ems
I found the issue. It was the Perfmon Counter Object that changed between 2003 and 2008.
Windows 2003:
Object = Process
Windows 2008:
Object = Process Information
All is working now.
I'm curious - I'm also seeing lots of the "Counter list is empty" error message, and also having a problem with collecting % Processor Time for the _Total instance - all my instances are returned regardless of which ones I specify in perfmon.conf.
I am also running UF 4.2.2 on 64bit Windows 2003 R2 and 4.2.2 on the Indexer (Windows 2008 R2). Have also posted this question - http://splunk-base.splunk.com/answers/27989/specific-perfmon-instance-collection-problem.
Have you seen similar behaviour in your installation? Or are you just getting the _Total instance as expected?
Are you sure the Processor Information perfmon object exists in Windows 2003? I thought that was a new one....