I have about 1500 Universal Forwarders installed in our environment.
The UF version is 6.3.1 and installed on Windows computers.
Recently, I mentioned that the splunkd process (which related to the splunk UF service) uses about 30-60% of the machine CPU in constant all the time!
You can accept with me that this is unacceptable behavior .
The inputs.conf on the UF configure to monitor log files, windows event logs, performance logs and processes memory consumption.
One thing I have done for trying to fix it is to add the property of
ignoreOlderThan = 120m for all the inputs in inputs.conf.
Unfortunately, this is not working as I expected and I still see the CPU of the UF very high (same as before).
What else I can do?
There is a way to limit the percent of the CPU consumption of UF?
There is maybe problem with UF 6.3.1 with CPU consumption?
Thanks for the supporting,
I was able to manage the CPU and memory consumptions of the Splunk agent using Intigua.
I was facing with this issue on my Exchenge servers and using Intigua I was able to throlle the CPU and memory consumption.
You can download it here: http://www.intigua.com/get-intigua
Have you tried disabling the recurse option on any monitor stanzas in inputs.conf?
I've had some issues with the 6.3.x forwarders and high cpu on using both the recurse option and wildcards in the monitor path. From my support requests it sounds like it's a known issue with short file names and there's a fix on the way.
Perhaps the UF is collecting data too often. Try setting higher values for
interval in the
perfmon stanzas of the inputs.conf file.