Hi,
i have a windows environment and universal forwarder installed on the servers and forwarding different type of logs.
i want to monitor the disk size for the server as its drives sometimes fills up with logs files and basically after that create an alert when it reaches a certain point.
i am using forwarder on the server with wmi.conf as it seems like the way to send that data.i tried using perfmon://LocalPhysicalDisk stanza with wmi.conf but i think that is only used for local systems so i am using WMI:LocalPhysicalDisk stanza now
this is what i set up on my wmi.conf from the splunk documentation but i think this only give me the disk and memory performance.i am sure there is an esay way to just get disk size but can't seem to find it.any help is greatly appreciated
[WMI:LocalPhysicalDisk]
interval = 300
wql = select Name, DiskBytesPerSec, PercentDiskReadTime,PercentDiskWriteTime, PercentDiskTime from \
Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = fam_perfmon
[WMI:LocalMainMemory]
interval = 300
wql = select CommittedBytes, AvailableBytes, PercentCommittedBytesInUse, Caption from \
Win32_PerfFormattedData_PerfOS_Memory
disabled = 0
index = fam_perfmon
Thanks alot in advance
↧