Hi All,
I have SPlunk forwarder installed on solaris servers and this seems to be occupying memory offlate. What could be the reason for this? N how to overcome this?
It occupies more than 500MB..
Check the number of open files. If Splunk is monitoring a large amount of individual files, the memory usage could expand drastically.
First, find the pid
of the main Splunk process. Normally this is done with a ps -ef | grep splunk
. Then take that pid
and put it into this command: lsof -p | wc -l
. This will count the number of open files for the forwarder. This number might be very high. If it is not very high (let's say < 10K), you may have other issues in play.
What version of Splunk forwarder? What version of Solaris?
Hi,
Thakyou for the response.
Actually I'm not able to run the lsof command on the solaris server. I Get the below error:
lsof: FATAL: lsof was compiled for a 32 bit kernel,
but this machine has booted a 64 bit kernel.
0
I have splunk UF version as:
Splunk Universal Forwarder 6.1.4 (build 233537)
Solaris version:
SunOS ss73fmoapq230 5.10 Generic_150401-23 i86pc i386 i86pc