I found this in my splunkd.log
and It seems linked to the setting rdnsMaxDutyCycle in limits.conf
I assume that it triggers when my reverse dns resolution takes too long.
what is too long, and what is the base value used to compare ?
8-27-2014 12:51:28.048 +0800 WARN TcpInputConfig - reverse dns lookups appear to be excessively slow, this may impact receiving from network inputs. 66.688940 % time is greater than configured rdnsMaxDutyCycle=10 %. Current lookup: host::XX.XX.XX.XX
It means if dns lookup take more than rdnsMaxDutyCycle % ( default 10% ) time of 15 sec then the log will appear. In this case dns lookup took 66.688940 % of 15 sec ( almost more than 10 sec).
It means if dns lookup take more than rdnsMaxDutyCycle % ( default 10% ) time of 15 sec then the log will appear. In this case dns lookup took 66.688940 % of 15 sec ( almost more than 10 sec).
That's internal to splunk.
where do you bring this 15seconds from ?
It is from hard-coded one unfortunately