Getting Data In

High Splunk Universal Forwarder CPU usage

certivox
New Member

Hi. We are trying to monitor one custom file in a non-syslogging service on a linux Ubuntu 11.04 64 bit server.

For some reason which we cannot fathom, the CPU usage is 50% all the time, which for our use case ( only one inputs.conf entry to monitor ONE file) is not making any sense. Why would an allegedly low overhead service show such a high CPU use?

I have run "splunk diag" on the machine and am uploading the resulting file in the hope that we will get some help.

The URL to the diag file is here: http://www.4shared.com/archive/Uudzp_MC/diag-couchproxy-live-1-2012-07.html

Tags (1)
0 Karma

gcoles
Communicator

This sounds like the same thing that happened to us on debian squeeze. Check out this post.

To fix, on the ubuntu server having issues, try these commands:

/etc/init.d/ntp stop
(date +"%H:%M:%S" |perl -pe 'chomp';echo `date +"%N"` / 999999999|bc -l) | sudo perl -ne 'chomp;system ("date","-s",$_);'
/etc/init.d/ntp start

If you don't have perl installed for some reason, you can replace the middle date command with a simpler one referenced in the post above.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...