Deployment Architecture

Splunk LF is utilizing a lot of CPU and Memory

balbano
Contributor

Hi all,

One of the servers we installed Splunk LF on is having high CPU and Memory Utilization as a result of Splunkd service. We have the most current version of Splunk LF installed on this host. I read through this article:

http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

However, is there any other resources or advice you have that will resolve this issue? Seems like light forwarder is a CPU and Memory hogger.

I can answer any questions you have that will help determine the best solution to this problem.

Thanks for you help in this.

Brian

Tags (1)
1 Solution

balbano
Contributor

Apparently there is nothing else that can be done... there are no CPU and Memory utilization issues with my other servers, which are 95% 2.6 Kernel and 90% RHEL5 and up... guess this server is simply trying to use splunk with an unsupported kernel.

Brian

View solution in original post

0 Karma

balbano
Contributor

Apparently there is nothing else that can be done... there are no CPU and Memory utilization issues with my other servers, which are 95% 2.6 Kernel and 90% RHEL5 and up... guess this server is simply trying to use splunk with an unsupported kernel.

Brian

0 Karma

balbano
Contributor

is http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint relevant for 4.x? I do not see etc/apps/SplunkLightForwarder/default/setup.conf. Let me know. Thanks.

0 Karma

balbano
Contributor

everything under /var/log. Not blacklisting or whitelisting anything... pretty much all I'm concerned about are the internal system logs being made via syslog-ng and the zeus access and error logs.... might be ideal to blacklist...

other than that... anything else I should be looking out for?

this is a really old server...

not to mention spunk apparently does not support 2.4 kernel...

0 Karma

balbano
Contributor

To give you guys more info... here are the server specs:

Dell Poweredge 1750, 2x Intel(R) Xeon(TM) CPU 2.40GHz w/ 512k cache, 4GB RAM

Running RHEL ES 3 32-bit with 2.4 Kernel

This sadly is a legacy server we cannot get rid of right now... which is the oldest server out of the test sample of servers we are testing Splunk LF on.

Anyone in a similar situation?

From my perspective all I care about is offloading the logs to the central indexer so if there are things I can do to better minimize the footprint like disable modules let me know.

Any help you can provide would be of great help to us...

Thanks again!!!

Brian

gkanapathy
Splunk Employee
Splunk Employee

How many directories are you monitoring? How many files are inside those directories in total? How many of those are whitelisted/blacklisted?

0 Karma

Lowell
Super Champion

Anyone inside splunk know if High CPU utilization with LFW and deployment client (SPL-26789) is still open? The workaround at the time (4.0.6ish) was to disable the deployment client..... ;-(

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...