What does slow reverse dns lookup warning mean in splunkd.log?

[mataharry]

I found this in my splunkd.log
and It seems linked to the setting rdnsMaxDutyCycle in limits.conf
I assume that it triggers when my reverse dns resolution takes too long.

what is too long, and what is the base value used to compare ?


8-27-2014 12:51:28.048 +0800 WARN TcpInputConfig - reverse dns lookups appear to be excessively slow, this may impact receiving from network inputs. 66.688940 % time is greater than configured rdnsMaxDutyCycle=10 %. Current lookup: host::XX.XX.XX.XX


[hsrawat · Accepted solution]

It means if dns lookup take more than rdnsMaxDutyCycle % ( default 10% ) time of 15 sec then the log will appear. In this case dns lookup took 66.688940 % of 15 sec ( almost more than 10 sec).

[hsrawat]

That's internal to splunk.

[mataharry]

where do you bring this 15seconds from ?

[sylim_splunk]

It is from hard-coded one unfortunately