Posted on June 9, 2020 2:04 am
 |  Asked by Ravicharan Kallem
 |  110 views
0
0
Print Friendly, PDF & Email

Hello,

We are running EOS 4.22.3 M, SplunkUniversalForwarder 6.6.2 and AristaApp 1.6.0, one thing we noticed with all these latest extensions is the high CPU load averages when running splunk-forwarder. If we shutdown the splunk load averages goes down to an average of 0.40 per minute, with splunk running it is always more than 1.00.

Below are the details.

oblf12-idev#show extensions
Name Version/Release Status Extension
———————————————– ——————– ———– ———
AristaAppForSplunk-1.6.0.swix 1.6.0/1.fc18 A, I 3
splunkforwarder-6.6.2-4b804538c686.i386.r\ 6.6.2/4b804538\ A, I 1
pm c686

A: available | NA: not available | I: installed | NI: not installed | F: forced
oblf12-idev#show version
Arista DCS-7010T-48
Hardware version: 22.02
Serial number: JPE17122574
System MAC address: 2899.3a67.ab07

Software image version: 4.22.3M
Architecture: i686
Internal build version: 4.22.3M-14418192.4223M
Internal build ID: a077fcd6-7c48-4b5d-9d76-bd5f7a250bd5

Uptime: 7 weeks, 3 days, 1 hours and 13 minutes
Total memory: 3990960 kB
Free memory: 2457204 kB

oblf12-idev#show uptime
01:54:55 up 52 days, 1:13, 2 users, load average: 1.41, 1.21, 1.16

oblf12-idev#show run sec splunk-forward
splunk-forwarder
splunk-server dev-spkidx01.naw01.inframon.viasat.io port 9997
splunk-server outputs.splunk.viasat.io port 9997
index inventory
index inventory interval 180
index topology
index topology interval 1800
index interface-counters
index interface-counters interval 120
index-data arista
http-commands protocol socket
no shutdown

 

Is there any Arista recommended Index intervals, we are trying to understand why the high CPU usage with current splunk. Previously we were running EOS 4.20.10M, SUF 7.1.2, AristaApp 1.5.0 and CPU load averages were pretty normal.

Please suggest what are the recommended versions of extensions for EOS 4.22.3M and index intervals.

Post your Answer

You must be logged in to post an answer.