All Apps and Add-ons

splunk process occuoying too much memory in solaris servers

sarnagar
Contributor

Hi All,

I have SPlunk forwarder installed on solaris servers and this seems to be occupying memory offlate. What could be the reason for this? N how to overcome this?
It occupies more than 500MB..

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Check the number of open files. If Splunk is monitoring a large amount of individual files, the memory usage could expand drastically.

First, find the pid of the main Splunk process. Normally this is done with a ps -ef | grep splunk. Then take that pid and put it into this command: lsof -p | wc -l. This will count the number of open files for the forwarder. This number might be very high. If it is not very high (let's say < 10K), you may have other issues in play.

What version of Splunk forwarder? What version of Solaris?

0 Karma

sarnagar
Contributor

Hi,
Thakyou for the response.
Actually I'm not able to run the lsof command on the solaris server. I Get the below error:

lsof -p 5523 |wc -l

lsof: FATAL: lsof was compiled for a 32 bit kernel,
but this machine has booted a 64 bit kernel.
0
I have splunk UF version as:

/opt/splunkforwarder/bin/splunk version

Splunk Universal Forwarder 6.1.4 (build 233537)

Solaris version:

uname -a

SunOS ss73fmoapq230 5.10 Generic_150401-23 i86pc i386 i86pc

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...