Running high CPU load on your VMware cluster with Splunk – Leap Second Issue
On 30 June we experienced a ‘leap second’. This is a correctional measure for a time discrepancy. As IT guys, we don’t like time shifts. A lot of systems handle sudden time shifts poorly, even if it’s just for 1 second. If you use Splunk, you can run into such an issue.
If you are running Splunk on your VMware environment, you might experience higher CPU load caused by the Splunk daemon. The solution can be found here. In short, run these commands on the CLI of your host and you should see the CPU load going back into the green:
- /etc/init.d/ntp stop
- (date +“%H:%M:%S” |perl –pe ‘chomp’;echo
date +"%N"/ 999999999|bc –l) | sudo perl –ne ‘chomp;system (“date”,”-s”,$_);’
- /etc/init.d/ntp start
To check if all your VMware products are in line with the leap second step, check these two articles at the VMware Knowledgebase:
- Support for Leap Seconds in VMware Products (2115818)
- VMware products unaffected by the Leap Second change (2121624)
Alex Muetstege works as a Technical Account Manager for VMware. In the past he worked presales and technical consultancy for several systems integrators. He has been involved in virtualization, especially with VMware, since the early days.
Alex is a certified VMware VCP, VSP and VTSP.
5 time VMware vExpert (2011-2017) and one time Cisco Champion (2015).