Getting Data In

Inputs.conf Settings for IAS Logs Takes 100% CPU

brian_meyer
Explorer

I've been pulling my hair out on this one for weeks and I'm finally to the point where I need a sanity check.

I'm just trying to pull logs from my IAS servers. One is 2008 R2 and the other 2012 R2. Both log to the default C:\windows\system32\logfiles\ folder.

I created a very basic app on my DS that would collect these files. Everything worked great until I noticed that both computers were always at 100% CPU utilization. Discovered it was due to the new app. Disable the app and restart the forwarder and CPU went back to normal.

I've changed just about every config on the app I can think of to try to discover what the issue is but no matter what I do the CPU spikes again. Even if I disable the app and but the monitor section in the system\local\inputs.conf file the CPU spikes.

My inputs.conf file is as basic as possible:
[monitor://C:\Windows\System32\LogFiles\*.log]
sourcetype=ias

Anyone have any ideas they can throw my way?

0 Karma
1 Solution

brian_meyer
Explorer

I think I may have fixed the issue by switching to the following inputs.conf config:

[monitor://C:\Windows\System32\LogFiles\]
whitelist=\.log$
sourcetype=ias

View solution in original post

0 Karma

brian_meyer
Explorer

I think I may have fixed the issue by switching to the following inputs.conf config:

[monitor://C:\Windows\System32\LogFiles\]
whitelist=\.log$
sourcetype=ias

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...