Getting Data In

High Splunk Universal Forwarder CPU usage

certivox
New Member

Hi. We are trying to monitor one custom file in a non-syslogging service on a linux Ubuntu 11.04 64 bit server.

For some reason which we cannot fathom, the CPU usage is 50% all the time, which for our use case ( only one inputs.conf entry to monitor ONE file) is not making any sense. Why would an allegedly low overhead service show such a high CPU use?

I have run "splunk diag" on the machine and am uploading the resulting file in the hope that we will get some help.

The URL to the diag file is here: http://www.4shared.com/archive/Uudzp_MC/diag-couchproxy-live-1-2012-07.html

Tags (1)
0 Karma

gcoles
Communicator

This sounds like the same thing that happened to us on debian squeeze. Check out this post.

To fix, on the ubuntu server having issues, try these commands:

/etc/init.d/ntp stop
(date +"%H:%M:%S" |perl -pe 'chomp';echo `date +"%N"` / 999999999|bc -l) | sudo perl -ne 'chomp;system ("date","-s",$_);'
/etc/init.d/ntp start

If you don't have perl installed for some reason, you can replace the middle date command with a simpler one referenced in the post above.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...