XenDesktop no session information

[turbo4diesel]

I failed

[bosburn_splunk]

Are ya'll running 5.0?

Check this out - http://docs.splunk.com/Documentation/Splunk/5.0.1/Installation/Aboutupgradingto5.0READTHISFIRST#The_...

The Windows performance monitoring input is now modular

The performance monitoring inputs for Windows now use the new modular input type. When you upgrade, Splunk replaces the existing scripted input with the new modular input. During the migration, Splunk saves the existing perfmon.conf file and renames it to perfmon.conf.migrated. It then copies the inputs defined in that file and places them into inputs.conf under similarly-named stanzas.

This has major impact for users who use the Splunk App for Microsoft Exchange and the Splunk App for Active Directory. Those apps use performance monitoring inputs extensively. If you use either of these apps, we suggest that you do not upgrade the apps until compatible versions are released.

For additional information on what a modular input is, read "Modular inputs overview" in the Developing Views and Apps for Splunk Web Manual.

[gdavid]

Yes, I am running a 5.0 forwarder. The app had compatibility listed with 5.0

[zasada123]

Testserver
1) Install splunk index
2) Install Xendesktop add-on
3) Enable receive 9997 port
4) Install UniversalForwarder
5) Copy TA-XD-VDA and TA-Forwarder to VMs or DDC SP_Home$\etc\app\
6) Edit TA-Forwarder outputs.conf set index address
7) enable powershell script execution
Done

[nickstone]

I am also seeing this error message, but with the XenApp add-on on a clean install of 5.0.2 universal forwarder for Windows x64. What steps are required to ressolve this

[gdavid]

any luck with this? i have the same problem. but also with WMI items.

[zasada123]

i don`t see Memory,Processor, LogicalDisk, Network Interface, PhysicalDisk ans Proccess

perfmon.conf
[PERFMON:CPULoad]
counters = % Processor Time;
disabled = 0
instances = _Total
interval = 180
object = Processor

[PERFMON:AvailableMemory]
counters = Available Bytes
disabled = 0
interval = 180
object = Memory

[PERFMON:PhysicalDisk]
counters = Split IO/Sec;Disk Reads/Sec;Disk Writes/Sec;Disk Transfers/Sec;Disk Bytes/Sec
disabled = 0
instances = *
interval = 180
object = PhysicalDisk

[PERFMON:LogicalDisk]
counters = Free Megabytes;% Free Space;Split IO/Sec;Disk Reads/Sec;Disk Writes/Sec;Disk Transfers/Sec;Disk Bytes/Sec;% Disk Time
disabled = 0
instances = *
interval = 180
object = LogicalDisk

[PERFMON:NetworkInterface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
disabled = 0
interval = 180
object = Network Interface

[PERFMON:RunningProcesses]
counters = % Processor Time;Virtual Bytes;IO Write Operations/sec;IO Read Operations/sec;ID Process;Page Faults/Sec;Elapsed Time;
instances = *
disabled = 0
interval = 180
object = Process

Splunkd.log says:

10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'Memory' in stanza - 'AvailableMemory' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'Processor' in stanza - 'CPULoad' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'LogicalDisk' in stanza - 'LogicalDisk' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'Network Interface' in stanza - 'NetworkInterface' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'PhysicalDisk' in stanza - 'PhysicalDisk' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon" splunk-perfmon - The object specified - 'Process' in stanza - 'RunningProcesses' in conf file is not valid.
10-04-2012 21:01:11.699 +0400 INFO ExecProcessor - Ran script: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xendesktop_perfmon, took 888.8 milliseconds to run, 0 bytes read, exited with code -1