topic Re: hostwide component in resource_usage.log in Splunk Dev

hostwide component in resource_usage.log

stanwin — Mon, 28 Jan 2019 15:22:00 GMT

What exactly is the hostwide component in below.

It is reporting the very high utilization of memory & subsequently the Splunkd process crashes.

The issue goes away on VM restart, but slowly hits saturation again in around a day..

Is it process in Splunk itself or is it a nix process.

It states: https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Whatdatagetslogged
host-level, dynamic CPU utilization and paging information.

Not much description here: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fhostwide

index=_* host=ukwkmh-vmua084 source="/opt/splunk/var/log/introspection/resource_usage.log" sourcetype = splunk_resource_usage

{   [-] 
     component:  Hostwide   
     data:  {   [-] 
         cpu_arch:   x86_64 
         cpu_count:  12 
         cpu_idle_pct:   13.45  
         cpu_system_pct:     20.37  
         cpu_user_pct:   66.18  
         forks:  13292498   
         instance_guid:  XXXXX  
         mem:    11910.879  
         mem_used:   10249.320

Re: hostwide component in resource_usage.log

renjith_nair — Tue, 29 Jan 2019 05:53:47 GMT

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

Re: hostwide component in resource_usage.log

stanwin — Tue, 29 Jan 2019 15:41:18 GMT

thanks Renjith!