topic Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell. in Getting Data In

High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

hcarvcamp — Thu, 30 Jun 2016 13:57:05 GMT

Hi, everyone

I have a simple PowerShell script that runs every 5 minutes grabbing data from a database.
I have noticed the memory climbs quite high (almost 4GB). I have an "output" is the Heavy Forwarder. Seems like the memory keeps climbing.

Print below, the processes:

Any suggestions?

Thank you,

Hugo Campelo.
_

Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

richgalloway — Thu, 30 Jun 2016 14:24:33 GMT

Are you sure the offending powershell process is related to Splunk. Not to be alarmist, but some ransomware use powershell to encrypt files.

Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

hcarvcamp — Thu, 30 Jun 2016 14:41:17 GMT

Rich,

When i STOP the UF, the highest consumption "die", and, back to the "normal" consumption.

Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

richgalloway — Thu, 30 Jun 2016 14:44:18 GMT

That would seem to confirm it's Splunk-related.

Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

hcarvcamp — Thu, 30 Jun 2016 14:49:26 GMT

Yeah,

But do you have any idea what can be?

Re: High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

spayneort — Thu, 30 Jun 2016 19:20:27 GMT

Are you running the ad-repl-stat.ps1 script on Windows Server 2012 R2?

http://blogs.splunk.com/2014/01/13/active-directory-replication-and-windows-server-2012-r2/