Hi, I am also facing similar issue and ran lsof -p <splunkd pid> and I'm getting below output:- COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME splunkd 43466 splunk cwd DIR 252,0 4096 2 / splunkd 43466 splunk rtd DIR 252,0 4096 2 / splunkd 43466 splunk txt REG 252,11 35421040 11564 /opt/splunkforwarder/bin/splunkd splunkd 43466 splunk mem REG 252,0 1868984 1029 /lib/x86_64-linux-gnu/libc-2.23.so splunkd 43466 splunk mem REG 252,0 138696 1133 /lib/x86_64-linux-gnu/libpthread-2.23.so splunkd 43466 splunk mem REG 252,0 1088952 16547 /lib/x86_64-linux-gnu/libm-2.23.so splunkd 43466 splunk mem REG 252,11 188904 11534 /opt/splunkforwarder/lib/libbson-1.0.so.0.0.0 splunkd 43466 splunk mem REG 252,11 310152 11495 /opt/splunkforwarder/lib/libmongoc-1.0.so.0.0.0 splunkd 43466 splunk mem REG 252,11 1025736 11502 /opt/splunkforwarder/lib/libsqlite3.so.0.8.6 splunkd 43466 splunk mem REG 252,11 662808 11493 /opt/splunkforwarder/lib/libarchive.so.13.2.2 splunkd 43466 splunk mem REG 252,0 14608 1027 /lib/x86_64-linux-gnu/libdl-2.23.so splunkd 43466 splunk mem REG 252,11 2974768 11497 /opt/splunkforwarder/lib/libcrypto.so.1.0.0 splunkd 43466 splunk mem REG 252,11 335432 11531 /opt/splunkforwarder/lib/libxmlsec1-openssl.so.1.2.20 splunkd 43466 splunk mem REG 252,11 499224 11512 /opt/splunkforwarder/lib/libxmlsec1.so.1.2.20 splunkd 43466 splunk mem REG 252,11 1855304 11530 /opt/splunkforwarder/lib/libxml2.so.2.9.4 splunkd 43466 splunk mem REG 252,0 31712 16568 /lib/x86_64-linux-gnu/librt-2.23.so splunkd 43466 splunk mem REG 252,0 162632 16559 /lib/x86_64-linux-gnu/ld-2.23.so splunkd 43466 splunk mem REG 252,11 108056 11483 /opt/splunkforwarder/lib/libz.so.1.2.8 splunkd 43466 splunk mem REG 252,11 73648 11501 /opt/splunkforwarder/lib/libbz2.so.1.0.3 splunkd 43466 splunk mem REG 252,11 481112 11504 /opt/splunkforwarder/lib/libssl.so.1.0.0 splunkd 43466 splunk mem REG 252,11 343080 11496 /opt/splunkforwarder/lib/libxslt.so.1.1.29 splunkd 43466 splunk mem REG 252,11 606680 11532 /opt/splunkforwarder/lib/libpcre2-8.so splunkd 43466 splunk mem REG 252,11 319256 11487 /opt/splunkforwarder/lib/libjemalloc.so.2 splunkd 43466 splunk 0r CHR 1,3 0t0 6 /dev/null splunkd 43466 splunk 1u REG 252,11 28798 11654 /opt/splunkforwarder/var/log/splunk/splunkd_stdout.log splunkd 43466 splunk 2u REG 252,11 24907 11656 /opt/splunkforwarder/var/log/splunk/splunkd_stderr.log splunkd 43466 splunk 3r REG 0,4 0 19849 /proc/sys/vm/overcommit_memory what can I check over here ?   ... View more