Hi guys, little help with this amazing program.
I recently installed the universal forwarder onto two 32 bit windows server machines and it forwarded all the data i needed. since then I've expanded onto two windows server 64 bit machines. these are sending all other information aside from Perfmon data. i've done a little research and a little thinking and have tried :
I restarted both splunk on the server and the local splunk service after this this has not worked 😞
all help much appreciated.
Since last time i have tried Re-installing splunk (had some IP Addressing issues which have been resolved)
Changed the "object" value of Processor to Processor Information as provided helpfully here:
Since then the other errors have appeared
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - PerfmonHelper::enumObjectByNameEx: PdhEnumObjectItems failed for object - 'Memory' with error (0xc0000bb8): The specified object was not found on the computer.
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Unable to add counter '\Processor Information()\% Processor Time' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk()\Free Megabytes' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\LogicalDisk(*)\% Free Space' error 0xc0000bb8
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui"
ERROR splunk-perfmon - Perfmon - Invalid counter -
Then after the initial Errors it continues with the below indefinetly.
09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-28-2011 16:01:46.629 +0800 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
My Perfmon.conf is as follows:
[PERFMON:CPU Load]
counters = % Processor Time;% User Time
disabled = 0
instances = _Total
interval = 10
object = Processor Information
[PERFMON:Available Memory]
counters = Available Bytes
disabled = 0
interval = 10
object = Memory
[PERFMON:Free Disk Space]
counters = Free Megabytes;% Free Space
disabled = 0
instances = _Total
interval = 10
object = LogicalDisk
[PERFMON:Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
disabled = 0
instances = *
interval = 10
object = Network Interface
Since the first time i asked this question a few more things i have tried:
Comparing the .conf (between the working 32-bit and non working 64-bit) files for the Universal Forwarder App and for the System, all of the .conf files where changed or the same.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Real-timeWindowsperformancemonitoring
Under: Configure local Windows performance monitoring with Splunk Web
The places this walktrhough point to i cannot find on my version of splunk (4.2.3)
splunkd.log is giving me :
09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:42.796 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:45.702 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
09-26-2011 19:57:48.286 +0800 ERROR TcpOutputProc - Can't find or illegal IP address or Name: pegasus
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:52.749 +0800 ERROR ExecProcessor - message from ""C:\Program Files (x86)\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick
09-26-2011 19:57:57.703 +0800 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected