Deployment Architecture

Splunk LF is utilizing a lot of CPU and Memory

Contributor

Hi all,

One of the servers we installed Splunk LF on is having high CPU and Memory Utilization as a result of Splunkd service. We have the most current version of Splunk LF installed on this host. I read through this article:

http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

However, is there any other resources or advice you have that will resolve this issue? Seems like light forwarder is a CPU and Memory hogger.

I can answer any questions you have that will help determine the best solution to this problem.

Thanks for you help in this.

Brian

Tags (1)
1 Solution

Contributor

Apparently there is nothing else that can be done... there are no CPU and Memory utilization issues with my other servers, which are 95% 2.6 Kernel and 90% RHEL5 and up... guess this server is simply trying to use splunk with an unsupported kernel.

Brian

View solution in original post

0 Karma

Contributor

Apparently there is nothing else that can be done... there are no CPU and Memory utilization issues with my other servers, which are 95% 2.6 Kernel and 90% RHEL5 and up... guess this server is simply trying to use splunk with an unsupported kernel.

Brian

View solution in original post

0 Karma

Contributor

is http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint relevant for 4.x? I do not see etc/apps/SplunkLightForwarder/default/setup.conf. Let me know. Thanks.

0 Karma

Contributor

everything under /var/log. Not blacklisting or whitelisting anything... pretty much all I'm concerned about are the internal system logs being made via syslog-ng and the zeus access and error logs.... might be ideal to blacklist...

other than that... anything else I should be looking out for?

this is a really old server...

not to mention spunk apparently does not support 2.4 kernel...

0 Karma

Contributor

To give you guys more info... here are the server specs:

Dell Poweredge 1750, 2x Intel(R) Xeon(TM) CPU 2.40GHz w/ 512k cache, 4GB RAM

Running RHEL ES 3 32-bit with 2.4 Kernel

This sadly is a legacy server we cannot get rid of right now... which is the oldest server out of the test sample of servers we are testing Splunk LF on.

Anyone in a similar situation?

From my perspective all I care about is offloading the logs to the central indexer so if there are things I can do to better minimize the footprint like disable modules let me know.

Any help you can provide would be of great help to us...

Thanks again!!!

Brian

Splunk Employee
Splunk Employee

How many directories are you monitoring? How many files are inside those directories in total? How many of those are whitelisted/blacklisted?

0 Karma

Super Champion

Anyone inside splunk know if High CPU utilization with LFW and deployment client (SPL-26789) is still open? The workaround at the time (4.0.6ish) was to disable the deployment client..... ;-(

0 Karma