Getting Data In

Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations."

khagan
Path Finder

A Splunk Universal Forwarder has been using an unusual amount of CPU (between 40% and 50%), specifically by splunk-winevtlog.exe. Checking the splunkd.log shows this error occurring fairly constantly:

INFO PipelineComponent - <process> took longer than seems reasonable (xxxxx milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations.

The offending process varies between "triggerCollection" and "metricsmanager:probeandreport". I can't find a clear indication of what either of these processes does.

The server has higher than the minimum recommendations - 4GB RAM and a 2.4 Ghz processor - so it shouldn't be hardware limitations. What other limitations can this error be referring to?

0 Karma

ddrillic
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...