Installation

Heavy forwarder has many "TcpInputProc - Input queue has pds" lines in splunkd.log

minhvt
Loves-to-Learn

After upgrade from 9.1.0 to 9.2.1, my heavy forwarder has many following lines in log:

 

04-01-2024 08:56:16.812 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:16.887 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:16.951 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:16.982 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.008 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.013 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.024 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.041 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.079 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.097 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.146 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.170 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.190 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.257 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.292 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.327 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.425 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.522 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.528 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.549 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.
04-01-2024 08:56:17.551 +0700 INFO  TcpInputProc [103611 FwdDataReceiverThread] - Input queue has pds 0 after reader thread stopped.

 

 

How to disable this log? Does any error related this INFO log?

Labels (1)
Tags (2)
0 Karma

wwangsa_splunk
Splunk Employee
Splunk Employee

Hello Champs,

This message is info only and can be safely ignored. Alternatively, you can turn it off by setting the TcpInputProc log level to WARN.

If you can't restart splunkd yet, simply run:
$SPLUNK_HOME/bin/splunk set log-level TcpInputProc -level WARN

To make the change persistent:
* Create or edit $SPLUNK_HOME/etc/log-local.cfg

* Add:
category.TcpInputProc=WARN

* Followed by splunkd restart.

nkoppert_s
Engager

Following this thread as well, as I have observed the same issue following an upgrade from 9.1.2 to 9.2.1

0 Karma

jonrsplunk
Explorer

Same with 9.1.4.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...