High consumption POWERSHELL in Active Directory without related processes Splunk-Powershell.

[hcarvcamp]

Hi, everyone

I have a simple PowerShell script that runs every 5 minutes grabbing data from a database.
I have noticed the memory climbs quite high (almost 4GB). I have an "output" is the Heavy Forwarder. Seems like the memory keeps climbing.

Print below, the processes:

Any suggestions?

Thank you,

Hugo Campelo.
_

[spayneort]

Are you running the ad-repl-stat.ps1 script on Windows Server 2012 R2?

http://blogs.splunk.com/2014/01/13/active-directory-replication-and-windows-server-2012-r2/

[richgalloway]

Are you sure the offending powershell process is related to Splunk. Not to be alarmist, but some ransomware use powershell to encrypt files.

[hcarvcamp]

Rich,

When i STOP the UF, the highest consumption "die", and, back to the "normal" consumption.

[richgalloway]

That would seem to confirm it's Splunk-related.

[hcarvcamp]

Yeah,

But do you have any idea what can be?