Splunk Search

Solaris *nix Splunkd high load average

Explorer

Using the Splunk App for *nix on Solair. splunkd has a very high load average. In 15 seconds it did an lstat of 6659 files. Not sure why so many files are being monitored.

Tags (4)
0 Karma

Explorer

problem solved:

modify: $SPLUNK_HOME/etc/apps/unix/local/inputs.conf
[monitor:///home/.../.bash_history]
disabled = 1

Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!