Monitoring Splunk

What does slow reverse dns lookup warning mean in splunkd.log?

mataharry
Communicator

I found this in my splunkd.log
and It seems linked to the setting rdnsMaxDutyCycle in limits.conf
I assume that it triggers when my reverse dns resolution takes too long.

what is too long, and what is the base value used to compare ?


8-27-2014 12:51:28.048 +0800 WARN TcpInputConfig - reverse dns lookups appear to be excessively slow, this may impact receiving from network inputs. 66.688940 % time is greater than configured rdnsMaxDutyCycle=10 %. Current lookup: host::XX.XX.XX.XX

Tags (3)
1 Solution

hsrawat
Explorer

It means if dns lookup take more than rdnsMaxDutyCycle % ( default 10% ) time of 15 sec then the log will appear. In this case dns lookup took 66.688940 % of 15 sec ( almost more than 10 sec).

View solution in original post

hsrawat
Explorer

It means if dns lookup take more than rdnsMaxDutyCycle % ( default 10% ) time of 15 sec then the log will appear. In this case dns lookup took 66.688940 % of 15 sec ( almost more than 10 sec).

hsrawat
Explorer

That's internal to splunk.

0 Karma

mataharry
Communicator

where do you bring this 15seconds from ?

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

It is from hard-coded one unfortunately

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...