All,
Is there a way to tune down the Splunk for AD app? It seems to use WAY too much CPU. I have tried it on a few different DCs all Windows 208 R2 and once installed CPU usage goes from 10-20% to 90%-100% easy.
( I would upload some examples but there is something on the site telling me I don't have karma? )
Here is a useful PDF for deploying Splunk in virtual environments: Splunk and VMware VMs Tech Brief
Also, here is the documentation for Monitor Active Directory
According to the docs, there will be an scripted input in %SPLUNK_HOME%\etc\system\local directory
with the stanza
[script://%SPLUNK_HOME%\bin\scripts\splunk-admon.path]
interval = 60
There will probably be some other stuff in there, but the interval
defines how often the script will collect data from AD. I don't know that the number will be 60, either, but the number is the number of seconds between script executions. So perhaps you could just make that a larger number...
So after some experimenting I found that this only happened on virtual machines.
In spite of plenty of CPU, RAM and IO it was happening. I went ahead and set priority to the storage and a memory reservation in vmware and CPU use dropped a lot. After that I increased to vCPU and it was a little better (50%) finally I set a CPU reservation of 2ghz and it it dropped to average use of about 30% (average utulization on the box was 5-10% before splunk for ad)
So I would say splunk for AD is still pretty heavy on box. Can we tune collection frequency at all?