Getting Data In

Unable to pull Perfmon Counter for %Processor Time Windows 2003 32-bit

larry_lind
New Member

Has anyone seen the errors below and know how to correct? This same perfmon.conf is applied to both Windows 2008 64-bit (working) and Windows 2003 32-bit (% Processor Time not working). The other counters are working just fine on both Windows 2008 and 2003. Running Splunk 4.2.2.

**ERRORS in splunkd.log**:  
07-22-2011 15:06:47.510 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Processor Information(*)\% Processor Time'  error 0xc0000bb8

07-22-2011 16:30:14.057 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick

**perfmon.conf**  
[Perfmon:LocalPhysicalDisk]  
interval = 60  
object = PhysicalDisk  
counters = % Disk Read Time; % Disk Write Time; % Disk Time; Current Disk Queue Length  
instances = _Total  
disabled = 0  
index = ems  

[Perfmon:LocalMainMemory]  
interval = 60  
object = Memory  
counters = % Committed Bytes In Use  
disabled = 0  
index = ems  

[Perfmon:Processor]  
interval = 60  
object = Processor Information  
counters = % Processor Time  
instances = _Total  
disabled = 0  
index = ems
Tags (2)
0 Karma

larry_lind
New Member

I found the issue. It was the Perfmon Counter Object that changed between 2003 and 2008.

Windows 2003:

Object = Process

Windows 2008:

Object = Process Information

All is working now.

0 Karma

neilamoran
Explorer

I'm curious - I'm also seeing lots of the "Counter list is empty" error message, and also having a problem with collecting % Processor Time for the _Total instance - all my instances are returned regardless of which ones I specify in perfmon.conf.

I am also running UF 4.2.2 on 64bit Windows 2003 R2 and 4.2.2 on the Indexer (Windows 2008 R2). Have also posted this question - http://splunk-base.splunk.com/answers/27989/specific-perfmon-instance-collection-problem.

Have you seen similar behaviour in your installation? Or are you just getting the _Total instance as expected?

0 Karma

neilamoran
Explorer

Are you sure the Processor Information perfmon object exists in Windows 2003? I thought that was a new one....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...