topic Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers? in All Apps and Add-ons

Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

arber — Thu, 09 Oct 2014 07:39:52 GMT

We have deployed the TA-DomainController-NT6 add-on from Windows Infrastructure App to 4 of our domain controllers.
In one of the domain controllers the powershell.exe process took more than 6 GB from 8 GB installed. We tried to restart the service but it will go up very fast approximately 1-2 GB per minute. In the other machines we don't face the issue. We have stopped the splunk service due to production impact. Why is it using so much resources ?
Is there anyway to control the amount of RAM used by spkunkd service ?

Another thing to notice is that this server produces a huge amount of logs 12 GB respect to the other servers 1-2 GB

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

lguinn2 — Fri, 10 Oct 2014 20:52:50 GMT

"this server produces a huge amount of logs" - is that compared to the other domain controllers or just to another server?

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

lguinn2 — Fri, 10 Oct 2014 20:59:36 GMT

Also - have you looked at the data? Is one DC busier or in trouble?

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

jrodman — Fri, 10 Oct 2014 21:33:14 GMT

I think it's fair to say that the goal of the app was not to have a 6-8GB powershell process. I think you should determine whether this powershell process is associated with the app (what are its args etc) and work with support to further define the problem.

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

arber — Sat, 11 Oct 2014 14:50:00 GMT

Yes compared to other dc-s it generates too much traffic. Can it be that since the server is producing so much load to not overload the network, the data are kept in RAM ? Resulting in Ram overload ?

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

arber — Mon, 13 Oct 2014 10:59:56 GMT

Also if i search the splunkd.log file i can find a lot of errors like this:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"" splunk-admon - AdQuery::ProcessMessage: Cannot get uSNChanged from message.

Nearly 90% of the entries inside the splunkd.log file. How can we fix this error ?? Can this be the reason ?

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

dstaulcu — Mon, 13 Oct 2014 12:20:26 GMT

Does the domain controller in question have a unique role among others? -Check properties of domain in ADUC and determine if the host has any specialized operations master roles.

Are you spreading load among domain controllers to highest degree possible through use of AD Sites and Services and routing of Microsoft client traffic via site-link cost?

Are any 3rd party applications routing directly to the domain controller in question? Can you spread the load of such application traffic across available domain controllers via load balancing or DNS round robin techniques?

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

AnilPujar — Tue, 08 Jul 2025 12:55:34 GMT

Did this error resolve? if yes, How?
@arber

Re: Why is the universal forwarder splunkd service using too much RAM on one of 4 domain controllers?

PickleRick — Tue, 08 Jul 2025 21:04:30 GMT

This is a thread in which latest response was 11 years ago. I wouldn't count on a reasonable answer.