Hi,
We are using a forwarder (7.1.6) and we are seeing high CPU and high memory for Splunk forwarder (One whole core of a 20 core box).
![alt text][1]
However we are only getting in a trickle of data, so it's not like we are getting in millions of log files!
![alt text][2]
Is there anything I can do, to see what is happening inside it.
This is a tail of the log
You have new mail in /var/spool/mail/autoengine
dell479srv autoengine /dell479srv2/apps/splunkforwarder_MxOne_Testing_Latest/var/log/
bash$ tail -f splunk/splunkd.log
02-19-2019 15:30:02.144 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:30:02.144 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:35:03.296 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:35:03.296 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:40:02.983 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:40:02.983 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:45:03.007 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:45:03.008 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:50:03.320 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
02-19-2019 15:50:03.320 +0100 INFO WatchedFile - Will begin reading at offset=0 for file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'.
[1]: /storage/temp/270597-2019-02-19-14-45-15-dell479srv-autoengine.png
[2]: /storage/temp/270598-2019-02-19-14-46-27-search-splunk-716.png
↧