Getting Data In

Troubleshooting queuess (parsing queue)

d_lim
Path Finder

Hi all,

I am having this issue whereby the logs are not coming in from the UF > Local HF > Regional HF > Indexer

There was also a local setting on limits.conf which could it possibly cause the blockup?
[thruput]
maxKBps = 30

 

On the Local HF splunkd.log, these are the errors -

02-17-2021 00:25:12.661 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:25:17.673 -0500 INFO TailReader - ...continuing.
02-17-2021 00:25:23.864 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:24.866 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:27.681 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:25:29.392 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:25:30.533 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:25:42.501 -0500 WARN HttpListener - Connection from 127.0.0.1:49251 didn't send us any data, disconnecting
02-17-2021 00:25:54.856 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:57.724 -0500 INFO TailReader - ...continuing.
02-17-2021 00:26:04.858 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:12.748 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:26:16.869 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:19.874 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:30.777 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:26:42.625 -0500 WARN HttpListener - Connection from 127.0.0.1:49305 didn't send us any data, disconnecting
02-17-2021 00:26:44.558 -0500 INFO TailReader - Continuing...
02-17-2021 00:26:49.560 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:27:31.935 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:27:32.885 -0500 INFO TailReader - ...continuing.
02-17-2021 00:27:33.088 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:27:37.886 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:27:41.867 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:27:42.635 -0500 WARN HttpListener - Connection from 127.0.0.1:49403 didn't send us any data, disconnecting
02-17-2021 00:27:47.902 -0500 INFO TailReader - ...continuing.
02-17-2021 00:27:56.078 -0500 WARN TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 514
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 5514
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 9997
02-17-2021 00:27:57.915 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:33.100 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:28:34.741 -0500 INFO TailReader - Continuing...
02-17-2021 00:28:37.968 -0500 INFO TailReader - ...continuing.
02-17-2021 00:28:39.753 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:41.866 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:28:42.906 -0500 WARN HttpListener - Connection from 127.0.0.1:49528 didn't send us any data, disconnecting
02-17-2021 00:28:42.976 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:44.768 -0500 INFO TailReader - Continuing...
02-17-2021 00:28:49.769 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...02-17-2021 00:25:12.661 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:25:17.673 -0500 INFO TailReader - ...continuing.
02-17-2021 00:25:23.864 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:24.866 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:27.681 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:25:29.392 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname..com_hostname_C83
02-17-2021 00:25:30.533 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:25:42.501 -0500 WARN HttpListener - Connection from 127.0.0.1:49251 didn't send us any data, disconnecting
02-17-2021 00:25:54.856 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:25:57.724 -0500 INFO TailReader - ...continuing.
02-17-2021 00:26:04.858 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:12.748 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:26:16.869 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:19.874 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:26:30.777 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:26:42.625 -0500 WARN HttpListener - Connection from 127.0.0.1:49305 didn't send us any data, disconnecting
02-17-2021 00:26:44.558 -0500 INFO TailReader - Continuing...
02-17-2021 00:26:49.560 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:27:31.935 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:27:32.885 -0500 INFO TailReader - ...continuing.
02-17-2021 00:27:33.088 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:27:37.886 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:27:41.867 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:27:42.635 -0500 WARN HttpListener - Connection from 127.0.0.1:49403 didn't send us any data, disconnecting
02-17-2021 00:27:47.902 -0500 INFO TailReader - ...continuing.
02-17-2021 00:27:56.078 -0500 WARN TcpInputProc - Stopping all listening ports. Queues blocked for more than 300 seconds
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 514
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 5514
02-17-2021 00:27:56.078 -0500 INFO TcpInputProc - Stopping IPv4 port 9997
02-17-2021 00:27:57.915 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:33.100 -0500 INFO HttpPubSubConnection - Running phone uri=/services/broker/phonehome/connection_10.10.10.10_8089_hostname.com_hostname_C83
02-17-2021 00:28:34.741 -0500 INFO TailReader - Continuing...
02-17-2021 00:28:37.968 -0500 INFO TailReader - ...continuing.
02-17-2021 00:28:39.753 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:41.866 -0500 ERROR PipelineComponent - Monotonic time source didn't increase; is it stuck?
02-17-2021 00:28:42.906 -0500 WARN HttpListener - Connection from 127.0.0.1:49528 didn't send us any data, disconnecting
02-17-2021 00:28:42.976 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...
02-17-2021 00:28:44.768 -0500 INFO TailReader - Continuing...
02-17-2021 00:28:49.769 -0500 WARN TailReader - Could not send data to output queue (parsingQueue), retrying...

Labels (2)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Is there any specific reason to set maxKBps=30, that is too low. I have seen that when you set maxKBps too low it causes problem when you have large number of UF.

 

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...