Restarting a universal forwarder on AIX, why do I get error "ulimit - Splunk may not work due to small data segment/resident memory limit"?

akdake — Thu, 28 Jul 2016 22:45:40 GMT

Hi,

I get the following error when I restart our universal forwarder for AIX,

05-24-2016 18:06:26.872 +0800 INFO  loader - Splunkd starting (build 272667).
...
05-24-2016 18:06:31.178 +0800 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Tue May 24 11:02:48 2016). Context: FileClassifier /etc/aixmibd.conf
05-24-2016 18:06:32.686 +0800 ERROR PropertiesMapConfig - Failed to save stanza [/etc/aixmibd.conf_Tue_May_24_18:06:31_2016_1121352529] (user: , app: , root: /opt/splunkforwarder/etc) to app learned: bad allocation
05-24-2016 18:06:34.475 +0800 ERROR PropertiesMapConfig - Failed to save stanza [/etc/binld.cnf_Tue_May_24_18:06:33_2016_1082875830] (user: , app: , root: /opt/splunkforwarder/etc) to app learned: bad allocation
05-24-2016 18:06:36.294 +0800 ERROR PropertiesMapConfig - Failed to save stanza [/etc/cdromd.conf_Tue_May_24_18:06:35_2016_793076919] (user: , app: , root: /opt/splunkforwarder/etc) to app learned: bad allocation
05-24-2016 18:06:38.105 +0800 ERROR PropertiesMapConfig - Failed to save stanza [/etc/dhcpcd.ini_Tue_May_24_18:06:37_2016_566613028] (user: , app: , root: /opt/splunkforwarder/etc) to app learned: bad allocation
....
05-24-2016 18:06:44.915 +0800 INFO  ulimit - Limit: virtual address space size: unlimited
05-24-2016 18:06:44.915 +0800 INFO  ulimit - Limit: data segment size: 134217728 bytes [hard maximum: unlimited]
05-24-2016 18:06:44.915 +0800 WARN  ulimit - Splunk may not work due to small data segment limit!
05-24-2016 18:06:44.915 +0800 INFO  ulimit - Limit: resident memory size: 33554432 bytes [hard maximum: unlimited]
05-24-2016 18:06:44.915 +0800 WARN  ulimit - Splunk may not work due to small resident memory size limit!
....

Any ideas for the ERROR? TKS

Re: Restarting a universal forwarder on AIX, why do I get error "ulimit - Splunk may not work due to small data segment/resident memory limit"?

ddrillic — Thu, 28 Jul 2016 22:49:31 GMT

It says -

It does say it clearly in the warnings -
WARN ulimit - Splunk may not work due to small data segment limit!

topic Restarting a universal forwarder on AIX, why do I get error "ulimit - Splunk may not work due to small data segment/resident memory limit"? in Getting Data In

Restarting a universal forwarder on AIX, why do I get error "ulimit - Splunk may not work due to small data segment/resident memory limit"?

Re: Restarting a universal forwarder on AIX, why do I get error "ulimit - Splunk may not work due to small data segment/resident memory limit"?