Getting Data In

High Splunk Universal Forwarder CPU usage

New Member

Hi. We are trying to monitor one custom file in a non-syslogging service on a linux Ubuntu 11.04 64 bit server.

For some reason which we cannot fathom, the CPU usage is 50% all the time, which for our use case ( only one inputs.conf entry to monitor ONE file) is not making any sense. Why would an allegedly low overhead service show such a high CPU use?

I have run "splunk diag" on the machine and am uploading the resulting file in the hope that we will get some help.

The URL to the diag file is here:

Tags (1)
0 Karma


This sounds like the same thing that happened to us on debian squeeze. Check out this post.

To fix, on the ubuntu server having issues, try these commands:

/etc/init.d/ntp stop
(date +"%H:%M:%S" |perl -pe 'chomp';echo `date +"%N"` / 999999999|bc -l) | sudo perl -ne 'chomp;system ("date","-s",$_);'
/etc/init.d/ntp start

If you don't have perl installed for some reason, you can replace the middle date command with a simpler one referenced in the post above.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...