Splunk Dev

Splunk *nix app- Not getting the processes in a specific interval

sujanaskumar
New Member

The *nix app is retrieving the process (sshd, httpd etc) details running on the unix/linux servers. However, few processes are not running (on few servers) for quite long time and its not retrieving those events. Is this the issue with the line count post 256 getting omitted . Does it help in anyway if i try to change the ulimit values . Please help with this.

Tags (1)
0 Karma

afamoyib
Path Finder

Did you get a chance to review the splunkd logs for any errors or things of that nature. If the interval time is setup on the input file with the exact time you want in seconds. That would be the next place to look at

0 Karma

sujanaskumar
New Member

Yes, its the ps.sh script getting data every 2 miuntes . Getting events from other servers and same processes, but from few other server for some processes, the events are missing. How to check this. No errors in the logs. Seems like its a miss happening at the client side. But not sure how to check this. Can adding CRCSalt= helps to fix this?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...