Getting Data In

High Splunk Universal Forwarder CPU usage

certivox
New Member

Hi. We are trying to monitor one custom file in a non-syslogging service on a linux Ubuntu 11.04 64 bit server.

For some reason which we cannot fathom, the CPU usage is 50% all the time, which for our use case ( only one inputs.conf entry to monitor ONE file) is not making any sense. Why would an allegedly low overhead service show such a high CPU use?

I have run "splunk diag" on the machine and am uploading the resulting file in the hope that we will get some help.

The URL to the diag file is here: http://www.4shared.com/archive/Uudzp_MC/diag-couchproxy-live-1-2012-07.html

Tags (1)
0 Karma

gcoles
Communicator

This sounds like the same thing that happened to us on debian squeeze. Check out this post.

To fix, on the ubuntu server having issues, try these commands:

/etc/init.d/ntp stop
(date +"%H:%M:%S" |perl -pe 'chomp';echo `date +"%N"` / 999999999|bc -l) | sudo perl -ne 'chomp;system ("date","-s",$_);'
/etc/init.d/ntp start

If you don't have perl installed for some reason, you can replace the middle date command with a simpler one referenced in the post above.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...