Heavy Forwarder tier queues are full. How to determine which configuration might be causing issues?

[daniel333]

All,

I am looking at the queues on my heavy forwarder tier which I use to proxy all our Universal Forwarders. The queues are looking full lately, it seemed to creep up on us. Any recommendation on determining which config might be causing issues?

thanks

[ryanoconnor]

Which queues specifically are being blocked up? Depending on where the blocking is occurring will help determine what might be going on. Have you tried using the DMC to visualize the queues?

If the index queue is being blocked on the Heavy Forwarder than yes the maxKbps setting may apply.

[somesoni2]

Check the limits.conf - maxKbps values might be limiting heavy forwarder's data transmissions to indexer and filling up the queue.

[daniel333]

My limits.conf setting for my Heavy Forwarders is this -

[root@LOCATIONp01SPLUNK303 default]# pwd
/opt/splunk/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/default
[root@LOCATIONp01SPLUNK303 default]# cat limits.conf
[thruput]
maxKBps = 0

[phadnett_splunk]

Hello Daniel, did you recently perform an upgrade?

[daniel333]

Yes we did. We moved from 6.3.3 to 6.4.1.

It's just my heavy forwarders, very easy to move back to 6.3.3 if you think that would be a factor?