Monitoring Splunk

Splunk Universal Forwarder(9.1.1) consume a lot of CPU and memory

Manami
New Member

I deployed splunk universal forwarder 9.1.1 on Linux servers which are running on VPC VSI in IBM Cloud.
Some servers are RHEL7 others are RHEL8. These servers send logs to Heavy Forwarder server.

After deployment, the memory usage was coming to high on each server and one of the server went down because of memory leak. CPU usage is also high as expected when the splunk process is running.

For example, one of the server's CPU usage increased 30% and consumed 5.7GB memory out of 14GB after the splunk process up.

How can I reduce the resource usage?

Labels (2)
0 Karma

jbuckner85
Path Finder

Hello @Manami ,

We are experiencing the same thing with Splunk Enterprise, Memory utilization on average went up ~30% and CPU load over 50% across the indexing tier when we moved to this version. I will let you know if anything is found with the recent case which was opened. Were you able to find the problem with the universal forwarder?

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...