Forwarder Using 100%

[dwilson333]

All,

Is there a way to tune down the Splunk for AD app? It seems to use WAY too much CPU. I have tried it on a few different DCs all Windows 208 R2 and once installed CPU usage goes from 10-20% to 90%-100% easy.

( I would upload some examples but there is something on the site telling me I don't have karma? )

[lguinn2]

Here is a useful PDF for deploying Splunk in virtual environments: Splunk and VMware VMs Tech Brief

Also, here is the documentation for Monitor Active Directory

According to the docs, there will be an scripted input in %SPLUNK_HOME%\etc\system\local directory with the stanza

[script://%SPLUNK_HOME%\bin\scripts\splunk-admon.path]
interval = 60

There will probably be some other stuff in there, but the interval defines how often the script will collect data from AD. I don't know that the number will be 60, either, but the number is the number of seconds between script executions. So perhaps you could just make that a larger number...

[dwilson333]

So after some experimenting I found that this only happened on virtual machines.

In spite of plenty of CPU, RAM and IO it was happening. I went ahead and set priority to the storage and a memory reservation in vmware and CPU use dropped a lot. After that I increased to vCPU and it was a little better (50%) finally I set a CPU reservation of 2ghz and it it dropped to average use of about 30% (average utulization on the box was 5-10% before splunk for ad)

So I would say splunk for AD is still pretty heavy on box. Can we tune collection frequency at all?