https://community.splunk.com/t5/Splunk-Enterprise/Splunk-High-Utilization/m-p/541257#M5041 <P>That's not really a log message.&nbsp; It's a command running on one of your Splunk servers, most likely the one that launched the HF.</P><P>Look in the heavy forwarder's splunkd.log for errors that suggest why it restarted.&nbsp; Also check /var/log/messages on the HF's server.&nbsp; I suspect the Linux out-of-memory (OOM) killer is stopping the process.</P><P>The solution is to determine why the HF is using so much memory and make changes to reduce the memory use.&nbsp; What inputs is the HF processing?&nbsp; Do you have useACK turned on?&nbsp; How many other HFs are there and do they also experience this problem?&nbsp; If not, how are they different?</P> Wed, 24 Feb 2021 18:32:49 GMT richgalloway 2021-02-24T18:32:49Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-High-Utilization/m-p/541174#M5036 <P>Hi All,&nbsp;</P><P>I would like to ask on why does out heavy forwarder are consistently restarting whenever this log show up.</P><P><STRONG>splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd</STRONG></P><P><STRONG>Currently it consumes 13 GB of Physical Memory</STRONG></P><P>What does it do? What is it for? and How can we solve this issue.&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture.PNG" style="width: 611px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13054iE1678AA21612F7DE/image-dimensions/611x150?v=v2" width="611" height="150" role="button" title="Capture.PNG" alt="Capture.PNG" /></span></P><P> </P> Wed, 24 Feb 2021 11:25:04 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-High-Utilization/m-p/541174#M5036 jadengoho 2021-02-24T11:25:04Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-High-Utilization/m-p/541257#M5041 <P>That's not really a log message.&nbsp; It's a command running on one of your Splunk servers, most likely the one that launched the HF.</P><P>Look in the heavy forwarder's splunkd.log for errors that suggest why it restarted.&nbsp; Also check /var/log/messages on the HF's server.&nbsp; I suspect the Linux out-of-memory (OOM) killer is stopping the process.</P><P>The solution is to determine why the HF is using so much memory and make changes to reduce the memory use.&nbsp; What inputs is the HF processing?&nbsp; Do you have useACK turned on?&nbsp; How many other HFs are there and do they also experience this problem?&nbsp; If not, how are they different?</P> Wed, 24 Feb 2021 18:32:49 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-High-Utilization/m-p/541257#M5041 richgalloway 2021-02-24T18:32:49Z