Splunk High Utilization

[jadengoho]

Hi All, 

I would like to ask on why does out heavy forwarder are consistently restarting whenever this log show up.

splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd

Currently it consumes 13 GB of Physical Memory

What does it do? What is it for? and How can we solve this issue. 

 

[richgalloway · Accepted solution]

That's not really a log message.  It's a command running on one of your Splunk servers, most likely the one that launched the HF.

Look in the heavy forwarder's splunkd.log for errors that suggest why it restarted.  Also check /var/log/messages on the HF's server.  I suspect the Linux out-of-memory (OOM) killer is stopping the process.

The solution is to determine why the HF is using so much memory and make changes to reduce the memory use.  What inputs is the HF processing?  Do you have useACK turned on?  How many other HFs are there and do they also experience this problem?  If not, how are they different?