"ThruputProcessor - Current data throughput (259 kb/s) has reached maxKBps." messages despite limits.conf file.

[msarro]

Hi everyone. I am receiving these messages on my forwarders:

10-16-2013 18:38:59.118 +0000 INFO  ThruputProcessor - Current data throughput (259 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

I actually have a limits.conf file deployed to all of my forwarders via an app. The contents of my limits.conf in the app/default directory are the following:

[thruput]
maxKBps = 0

Is there any reason this would not be listened to?

[MuS · Accepted solution]

Hi msarro,

you can run btool and see if your limits.conf gets applied

$SPLUNK_HOME/bin/splunk cmd btool limits list thruput

hope this helps ...

cheers, MuS

[Shephali]

Hello,

I have a similar concern, where the maxKBps settings seem to be not getting applied.

The btool output on the UF is:
$/opt/splunk/laa/splunkforwarder/bin/splunk btool limits list --debug | grep -i maxkbps
/opt/splunk/laa/splunkforwarder/etc/apps/highoutput_forwarders/local/limits.conf maxKBps = 4096

But still we receive messages like " Current data throughput (1024 kb/s) has reached maxKBps” in the splunkd.log

Any suggestions?
Thanks in advance,
Shephali

[MuS]

Hi Shephali,

There are multiple possible reasons why this is not working:

1. the option must be set under the [thruput] stanza in limits.conf
2. btool does NOT actually show the config Splunk is using, it just merges the on disk files and shows the potential config being used by Splunk
3. to see the actual live config Splunk uses run $SPLUNK_HOME/bin/splunk show config limits
4. check / verify file permissions
5. last but not least it could be a bug?

cheers, MuS