Forums: SplunkPreview: Memory usage?

Anyone else having memory leak issues? One two different test machines splunk preview started about between 50-80M and eventually grew to over 700M. (This was on WinXP and Win2003Server one set to store locally and one to only forward to non preview splunk server).

CK

CK,

Which memory are you talking about, is this the virtual memory size, or the actual memory usage size.

How long had Splunk been running for?

Since the last preview release we have fixed several major memory usage issues...

Thanks,
Ledio

Well I restarted it on the 14th (both machines) and now it's back up there. WinServer2003 mem=254, vmem=338 WindowsXP mem=295, vmem=534.

I am getting 400MB to 1.6GB memory on Windows 2003 Server with Splunk 3.2. It grows over time, and is only monitoring the security event log for the system it's on. I hope this gets fixed, or that there is a fix. I can't justify that kind of memory usage to the engineers on my program.

[Revised on Mon, 31 Mar 2008 09:16:23 -0700]

CPU Usage is 0 while I looked at the task manager. If I kill the service it goes back to around 400MB, but after a couple days it's up near 1 GB again.

[Revised on Mon, 31 Mar 2008 09:18:04 -0700]

version 3.2-33572

aoberlander -

Thanks for the report. We don't want you to have to justify that kind of memory usage to your engineers! To help us get a fix, I opened a case on your behalf with our support team. While I am waiting for next steps from support, please feel free to upgrade to version 3.2.2, as it has fixed a few bugs from 3.2.

-araitz

We are using 3.2 on eight Solaris systems. After one week of tailing our mail logs, Splunk used up 700Mb on one machine and at least 500Mb on the other 7.

Does 3.2.2 fix the memory leaks?

jmfowler

I don't think that Splunk necessarily has a memory leak. It is quite normal if you are tailing and parsing a large amount of data on the forwarder for Splunk to utilize some memory. Does this description fit your use case?

As for 3.2.2, I would recommend upgrading for Solaris. The biggest change in 3.2.2 was that we are leveraging a more efficient memory library in Solaris than we were previously.