I've noticed a bug in snow.py where a restart of the splunk service causes abandoned processes, eventually consuming all available memory triggering alerts. I usually find about 5 processes run. Has any one else experienced this?
This is not the only installation I've seen this occur with.
I already have my own workaround which does require a little rewrite.
That is a Bad Thing(TM) which is not supposed to happen. Please file a support ticket so we can get a diag file, figure out why it is happening, and stop it from happening in the future.