Posted on June 9, 2020 2:04 am
 |  Asked by Ravicharan Kallem
 |  275 views
RESOLVED
0
0
Print Friendly, PDF & Email

Hello,

We are running EOS 4.22.3 M, SplunkUniversalForwarder 6.6.2 and AristaApp 1.6.0, one thing we noticed with all these latest extensions is the high CPU load averages when running splunk-forwarder. If we shutdown the splunk load averages goes down to an average of 0.40 per minute, with splunk running it is always more than 1.00.

Below are the details.

oblf12-idev#show extensions
Name Version/Release Status Extension
———————————————– ——————– ———– ———
AristaAppForSplunk-1.6.0.swix 1.6.0/1.fc18 A, I 3
splunkforwarder-6.6.2-4b804538c686.i386.r\ 6.6.2/4b804538\ A, I 1
pm c686

A: available | NA: not available | I: installed | NI: not installed | F: forced
oblf12-idev#show version
Arista DCS-7010T-48
Hardware version: 22.02
Serial number: JPE17122574
System MAC address: 2899.3a67.ab07

Software image version: 4.22.3M
Architecture: i686
Internal build version: 4.22.3M-14418192.4223M
Internal build ID: a077fcd6-7c48-4b5d-9d76-bd5f7a250bd5

Uptime: 7 weeks, 3 days, 1 hours and 13 minutes
Total memory: 3990960 kB
Free memory: 2457204 kB

oblf12-idev#show uptime
01:54:55 up 52 days, 1:13, 2 users, load average: 1.41, 1.21, 1.16

oblf12-idev#show run sec splunk-forward
splunk-forwarder
splunk-server dev-spkidx01.naw01.inframon.viasat.io port 9997
splunk-server outputs.splunk.viasat.io port 9997
index inventory
index inventory interval 180
index topology
index topology interval 1800
index interface-counters
index interface-counters interval 120
index-data arista
http-commands protocol socket
no shutdown

 

Is there any Arista recommended Index intervals, we are trying to understand why the high CPU usage with current splunk. Previously we were running EOS 4.20.10M, SUF 7.1.2, AristaApp 1.5.0 and CPU load averages were pretty normal.

Please suggest what are the recommended versions of extensions for EOS 4.22.3M and index intervals.

0
Posted by Prajna Amey
Answered on July 19, 2021 4:04 pm

Hello Ravi,

The high CPU load could be observed because of the short interval time between the indexes in the said EOS version. Based on our testing and understanding, the following steps have brought the CPU load down:

  1. Increase inventory interval to 3600s (index inventory interval 3600)
  2. Increase interface-counter to a higher value 1800s (index interface-counters interval 1800) or set it to a default value 60s (index interface-counters interval 60)

If you have any further questions please feel free to reach out to splunkforwarder-dev@arista.com

Post your Answer

You must be logged in to post an answer.