All Apps and Add-ons

ps_sos.sh script in SoS app uses wrong splunkd process?

ashleyherbert
Communicator

I've found a bit of a bug with the ps_sos.sh script that's a part of this app.
After a couple of restarts of our Splunk server, I noticed that the memory footprint shown in the SOS app was changing dramatically.

There are 2 splunkd processes that run on the server (splunkd & splunk helpers), and the script only returns the resource usage of the first of those 2 processes. Upon restarts it appears to change which one it returns, so the resource usage changes dramatically.

I'm running on a 64bit Linux server. Is this a known issue?

Otherwise, great app!

Cheers,

Ashley

hexx
Splunk Employee
Splunk Employee

12/06 UPDATE: We have made some changes in version 2.3.1 of the S.o.S app that should prevent this problem from happening. The aggregated CPU and memory usage statistics for type "searches" will now account for both the main and helper processes of every search.


Thank you for the feedback, Ashley. I have not seen that happen in our tests. We use the first PID in the $SPLUNK_HOME/var/run/splunk/splunkd.pid file to pick the ps row corresponding to the main splunkd process. Would you be able to tell us if on your system that first PID is sometimes that of the helper process and not the main splunkd?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...