Why is there high Mongod CPU usage on the search head?

[omprakash9998]

Hi,

On my search head, Mongod is consuming most of my CPU usage:

**115786 splunk    20   0   40.4g  10.6g  10.5g S  93.8 68.3   7416:45 mongod**
 81093 splunk    20   0  262404  96308  13996 S   6.2  0.6   0:03.92 splunkd
     1 root      20   0  193856   4640   2876 S   0.0  0.0   3:31.64 systemd

Is this ok? If not please help me how to resolve this.

Thanks,
Om

[vr2312]

There is a possibility that a default splunk app/add-on is using the KV Store resources that is spiking up the CPU usage. You might want to check on it manually and disable the operation to help it from crashing or high utilization.

[omprakash9998]

The below cmd is using lots of CPU. Please hrelp me resolve this issue.

***`mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=400 --keyFile=/opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --setParameter=oplogFetcherSteadyStateMaxFetcherRestarts=0 --replSet=C05774DE-5404-499E-B70B-2313F5C3E303 --bind_ip=0.0.0.0 --sslMode=requireSSL --sslAllowInvalidHostnames --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --sslDisabledProtocols=noTLS1_0,noTLS1_1 --sslCipherConfig=`***

[bazanha]

Is there a way to know which APP is using KV and stressing MongoDB?
I have this problem.
MongoDB is consuming more than 60% of the CPU.
Please, someone help me ???

[omprakash9998]

How do we look for the app/add-on manually that are using KV store resources.

Thanks,
Om

[renjith_nair]

Do you have a lot of KVSTORE look ups and operations ?

[omprakash9998]

No. we do not have lots of KV Store lookups. Its a basic splunk install . we run only few apps like Windows Infrastructe and a Cisco App