Hi,
We are currently not monitoring for Registry items on our UniversalForwarder, but the indexer that is receiving windows events from the forwarder is telling us that the splunk-regmon executable is running, I am guessing its default number of times per hour.
How is this disabled so that regmon is not started when we do not monitor for these items.
Thx.
I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.
I had a similar issue with UF 6.1.3. I contacted support and finally discovered that it was a known bug ( SPL-92479). It impacted 6.2.1 also. Try updating your UF to 6.2.2 or 6.2.3. It may be fixed in later versions.
I'll check back with support to get confirmation if it was fixed in either of the newer versions.
thx.
I was told by support that SPL-92479 was fixed as of Jan 23, 2015.
What version of the UF was released on or after that date?
Splunk just released 6.2.3 as of May 1st, and 6.2.2 was some time after Jan 23rd, I believe.
I haven't installed the UF yet to verify if its fixed there.
However, I don't know if this is my problem because I am also seeing this in my indexer with both 6.2.1 and 6.2.3.
I'm seeing this with at least the Registry monitor, host print monitor, and network monitor.
What version of UF are you running?
We are using Splunk 6.2.1 on both Indexers and UF. Both are showing regmon running every minute.
The indexer is even showing the default Registry monitoring items as disabled.
Thx for any help.