Universal Serial Bus Controller Windows 10

0 views

Skip to first unread message

Derrick Drescher

unread,

Aug 3, 2024, 4:33:24 PM8/3/24

to foursboudicas

I have a single instance Splunk 7.1.2 on Windows platform. I am getting lot of events related to Perfmon:Network_Interface , Perfmon:Memory from every Windows hosts that i have UF installed on. despite not having anything Enabled under ( Web UI >> Settings >> Data Inputs >> Remote performance Monitoring ) . Every counter or input under here as in (Settings >> Data Inputs >> Remote performance Monitoring ) is disabled.

I have checked this post, there is no perfmon.conf file under my C:\SplunkUniversalForwarder\etc\system\default directory on each Windows client. What is then making Splunk ES collect or fetch these perfmon related stats from and how to disable it ?

The /Splunk_TA_microsoft_ad/default/inputs.conf has some inputs enabled by default and we need to create a local inputs.conf to turn them off. If you are not using the "TA for AD" but just the TA for Windows then you would focus on the "TA for Windows" inputs.conf

I have the same issues. In my deployment server i put a local inputs.conf and disable perfmon, but I still receive data.
I had to put the same settings in Splunk_TA_windows.
Now I still receive perfmon CPU Load and perfrom Available Memory, but in main index.
I cannot figure out where to disable, because I disable both in Splunk_TA_windows and Splunk_TA_windows_AD, but I still receive those perfmon metrics in main index (even if I defined perfmon index for those metrics).
I think I will open a ticket.

Splunk on Windows ships with several Windows-only inputs. They are defined in the default inputs.conf and are enabled by default.
You should explicitly define the monitor input like below, under etc\apps\Splunk_TA_windows\default\inputs.conf, to overwrite default settings. I've had the same issue in the past.

@nittala_surya, isn't that redundant work ? i have re-checked , every input is set to disabled =1 in \etc\apps\Splunk_TA_windows\default\inputs.conf by default. Are you guys suggesting despite of this, we need to add those inputs in local\inputs.conf and again set them to disabled =1 ?

What is causing Splunk on Windows to enable them in the first place then ?

No. In \etc\apps\Splunk_TA_windows\default\inputs.conf, perfmon input is not explicitly disabled which means, no one is telling splunk to disable 'perform' at higher precedence level and hence, system/default(least precedence) is applied to these inputs.
In short, yes, you should add the input and disable it at a higher directory structure.

@ nittala_surya, it turns out the cause of problem was etc/apps/Splunk_TA_microsoft_ad/default/inputs.conf & not etc/apps/Splunk_TA_windows/default/inputs.conf . So i had to create a local inputs.conf inside the TA_microsoft_AD folder. This TA for AD also comes into picture when you install the "Splunk App for Windows Infrastructure". I again confirmed with support, that perfmon stats are disabled by default in "Splunk_TA_Windows" which was the source of confusion earlier.

Hello rmjharris, i agree i did not edit anything there. However, everything (every input) under etc\apps\Splunk_TA_windows\default\inputs.conf is set to disabled =1 by default. So there should be nothing more to do as in there shouldn't be any need for us to re define the perfmon inputs again in the local\inputs.conf when they are already disabled by default, correct ?
Not sure what is causing Splunk to collect those perfmon stats then.

@rmjharris i never said edit the conf in the default folder is said, check it. i have had several instances where the default has things enabled and the only way to check them to see if theyre disable is to look in the default folder to see whats enabled and whats not. Then follow my instructions which are identical to yours.

Correct, there are only 2 hosts that we are monitoring at the moment. This is because we just setup Splunk 3 - 4 days back. Both are Windows AD domain controllers. The plan is to get Windows clients configured correctly & then move on to Linux clients which are a handful.

Install a Windows universal forwarder using an installer or the command line. Use the installer for larger deployments and the command line for smaller deployments. Before you begin, see the universal forwarder deployment prerequisites. See Deploy the universal forwarder for a list of high-level steps to take before and after installing the universal forwarder.

For security purposes, avoid running the universal forwarder as a local system account or domain user, as it provides the user with high-risk permissions that aren't needed. When you install version 9.1 or higher of the universal forwarder, the installer creates a virtual account as a "least- privileged" user called splunkforwarder, which provides only the capabilities necessary to run the universal forwarder.

Since local user groups are not available on the domain controller, the GROUPPERFORMANCEMONITORUSERS flag is unavailable, which might affect WMI/perfmon inputs. To mitigate input issues,, when you're installing with the installer, the default account is the local system on the domain controller.

In addition to security issues, this can also lead to performance issues; since the universal forwarder is able to read far more files than before, more resources such as CPU, memory, and disk input/output are consumed.

Always create a password for the Splunk admin user. If you do not, then the universal forwarder can start with no defined users, which means that you cannot log in or make changes to the initial forwarder configuration.

The installer for the full version of Splunk Enterprise has its own set of installation flags. For information on the full Splunk installer, see Install on Windows in the Splunk Enterprise Installation Manual.

Without this SeImpersonatePrivilege privilege, you might not be able to grant more permissions by adding the Splunk forwarder user to any Windows group. This includes the Windows builtin group Performance Monitor Users (as mentioned in the next row) to enable WMI & perfmon inputs.

By default, the universal forwarder uses a local system account on the domain controller and as of 9.1, the default user is the least privileged user. Since the universal forwarder user is not added to the local admin group by default, you might experience permission issues, particularly if you have installed any custom add-ons that require additional permissions. You can manually grant the additional permissions by adding the universal forwarder user to user groups:

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

The universal serial bus controller is an important element of Windows OS. It refers to the driver programming interface that interacts with USB connectors, host controllers, and USB devices. If you face any Universal serial bus controller issue, your system might not recognize USB devices like keyboards, mice, pen drives, etc. Here we have discussed a few solutions that could help you fix Universal serial bus controller issues.

Any problem with the Universal serial bus (USB) controller driver can be easily identified and found in the Driver Manager. Generally, you will see the Universal serial bus controller (USB controller) listed under other devices with a yellow exclamation mark that signifies the USB controller does not have the right driver. An easy solution to this problem is uninstalling the Universal serial bus controller driver. Here are the steps to follow to uninstall the USB Driver.

If you look closely at the Universal serial bus controllers section in the Device Manager, you will find Generic USB hub entries. According to Windows experts, the generic hub splits one USB port into multiple ports available on your computer. The problem related to the Universal serial bus controllers might be linked to an outdated generic USB hub driver.

Driver Updater is one of the best driver update tools out there. Outbyte Driver Updater will give you access to a database of over 1 million drivers. It will regularly scan your PC, suggesting new driver versions to install. Driver Updater contains drivers for a variety of Windows devices. With just one click, you can update drivers in your system.

Many people spend money unnecessarily replacing laptop batteries when they may have fixed the issue with a simple battery reset or a Drivers update. If you are having problems charging your laptop battery, then reading this post may save you a lot of time, money and frustration!

The download has been tested by an editor here on a PC and a list of features has been compiled; see below. We've also created some screenshots of XOutput to illustrate the user interface and show the overall usage and features of this DirectInput converting program.

XOutput is a software that can convert DirectInput into XInput. DirectInput data is read and sent to a virtual XInput (Xbox 360 Controller) device. XInput is the new standard game controller input on windows, and DirectInput can no longer be used with Universal Windows Platform software, but with this tool you can use DirectInput devices as well.If you have an older or not supported game controller (gamepad, wheel, joystick, etc.), but XBox 360 controllers are supported you can use this software and enjoy gaming with your controller.On the configuration screen there are 3 blocks. The left block shows the input, the right one shows the emulated output and in the middle is where the mapping can be set. For each output axis or button, you can choose from the input axes and buttons.