High Splunk Universal Forwarder CPU usage

certivox — Sun, 08 Jul 2012 09:24:32 GMT

Hi. We are trying to monitor one custom file in a non-syslogging service on a linux Ubuntu 11.04 64 bit server.

For some reason which we cannot fathom, the CPU usage is 50% all the time, which for our use case ( only one inputs.conf entry to monitor ONE file) is not making any sense. Why would an allegedly low overhead service show such a high CPU use?

I have run "splunk diag" on the machine and am uploading the resulting file in the hope that we will get some help.

The URL to the diag file is here: http://www.4shared.com/archive/Uudzp_MC/diag-couchproxy-live-1-2012-07.html

Re: High Splunk Universal Forwarder CPU usage

gcoles — Mon, 09 Jul 2012 05:03:34 GMT

This sounds like the same thing that happened to us on debian squeeze. Check out this post.

To fix, on the ubuntu server having issues, try these commands:

/etc/init.d/ntp stop
(date +"%H:%M:%S" |perl -pe 'chomp';echo `date +"%N"` / 999999999|bc -l) | sudo perl -ne 'chomp;system ("date","-s",$_);'
/etc/init.d/ntp start

If you don't have perl installed for some reason, you can replace the middle date command with a simpler one referenced in the post above.

topic High Splunk Universal Forwarder CPU usage in Getting Data In

High Splunk Universal Forwarder CPU usage

Re: High Splunk Universal Forwarder CPU usage