Splunk Enterprise

Splunk High Utilization

jadengoho
Builder

Hi All, 

I would like to ask on why does out heavy forwarder are consistently restarting whenever this log show up.

splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd

Currently it consumes 13 GB of Physical Memory

What does it do? What is it for? and How can we solve this issue. 

Capture.PNG

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That's not really a log message.  It's a command running on one of your Splunk servers, most likely the one that launched the HF.

Look in the heavy forwarder's splunkd.log for errors that suggest why it restarted.  Also check /var/log/messages on the HF's server.  I suspect the Linux out-of-memory (OOM) killer is stopping the process.

The solution is to determine why the HF is using so much memory and make changes to reduce the memory use.  What inputs is the HF processing?  Do you have useACK turned on?  How many other HFs are there and do they also experience this problem?  If not, how are they different?

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not really a log message.  It's a command running on one of your Splunk servers, most likely the one that launched the HF.

Look in the heavy forwarder's splunkd.log for errors that suggest why it restarted.  Also check /var/log/messages on the HF's server.  I suspect the Linux out-of-memory (OOM) killer is stopping the process.

The solution is to determine why the HF is using so much memory and make changes to reduce the memory use.  What inputs is the HF processing?  Do you have useACK turned on?  How many other HFs are there and do they also experience this problem?  If not, how are they different?

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!