https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-Settings-for-IAS-Logs-Takes-100-CPU/m-p/249036#M47922 <P>I've been pulling my hair out on this one for weeks and I'm finally to the point where I need a sanity check.</P> <P>I'm just trying to pull logs from my IAS servers. One is 2008 R2 and the other 2012 R2. Both log to the default <CODE>C:\windows\system32\logfiles\</CODE> folder.</P> <P>I created a very basic app on my DS that would collect these files. Everything worked great until I noticed that both computers were always at 100% CPU utilization. Discovered it was due to the new app. Disable the app and restart the forwarder and CPU went back to normal.</P> <P>I've changed just about every config on the app I can think of to try to discover what the issue is but no matter what I do the CPU spikes again. Even if I disable the app and but the monitor section in the system\local\inputs.conf file the CPU spikes.</P> <P>My inputs.conf file is as basic as possible:<BR /> <CODE>[monitor://C:\Windows\System32\LogFiles\*.log]</CODE><BR /> <CODE>sourcetype=ias</CODE></P> <P>Anyone have any ideas they can throw my way?</P> Wed, 27 Jan 2016 15:24:40 GMT brian_meyer 2016-01-27T15:24:40Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-Settings-for-IAS-Logs-Takes-100-CPU/m-p/249036#M47922 <P>I've been pulling my hair out on this one for weeks and I'm finally to the point where I need a sanity check.</P> <P>I'm just trying to pull logs from my IAS servers. One is 2008 R2 and the other 2012 R2. Both log to the default <CODE>C:\windows\system32\logfiles\</CODE> folder.</P> <P>I created a very basic app on my DS that would collect these files. Everything worked great until I noticed that both computers were always at 100% CPU utilization. Discovered it was due to the new app. Disable the app and restart the forwarder and CPU went back to normal.</P> <P>I've changed just about every config on the app I can think of to try to discover what the issue is but no matter what I do the CPU spikes again. Even if I disable the app and but the monitor section in the system\local\inputs.conf file the CPU spikes.</P> <P>My inputs.conf file is as basic as possible:<BR /> <CODE>[monitor://C:\Windows\System32\LogFiles\*.log]</CODE><BR /> <CODE>sourcetype=ias</CODE></P> <P>Anyone have any ideas they can throw my way?</P> Wed, 27 Jan 2016 15:24:40 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-Settings-for-IAS-Logs-Takes-100-CPU/m-p/249036#M47922 brian_meyer 2016-01-27T15:24:40Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-Settings-for-IAS-Logs-Takes-100-CPU/m-p/249037#M47923 <P>I think I may have fixed the issue by switching to the following inputs.conf config:</P> <P><CODE>[monitor://C:\Windows\System32\LogFiles\]</CODE><BR /> <CODE>whitelist=\.log$</CODE><BR /> <CODE>sourcetype=ias</CODE></P> Wed, 27 Jan 2016 16:59:47 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-Settings-for-IAS-Logs-Takes-100-CPU/m-p/249037#M47923 brian_meyer 2016-01-27T16:59:47Z