This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Log forwarder - 100% CPU spike

miles53 over 13 years ago

We recently tried to install Solarwinds log forwarder to monitor our firewall "health". No problem with the install. We are using SQL server 2008. Its average CPU usage is about 10%. The memory stays at 85%. Everytime I try to implement a subscription (system or application selection) through the log forwarder, my CPU spikes and holds at 100%. Of course everytime this happens, everything else freezes up. I have seen posts in here related to the same problem, but never a resolution. Has anyone found the root cause of this type of problem. We have no wireless systems and recently increased our memory on the server. I'd like to try this out before we purchase software but it's obviously hard to test drive it at this rate. Thanks a lot

0 Kuz over 13 years ago

Hi miles53,
Couple of questions:
1. At what point in the Subscription Wizard does the CPU spike occur?
2. Does the CPU return to normal levels after the subscription wizard completes?
3. Can I ask what OS you're running?
4. What are your current system and application event log counts like?
-Mike
Cancel
Vote Up 0 Vote Down

Cancel
0 miles53 over 13 years ago in reply to Kuz

Thanks for the reply. It would seem that my supervisor was in error about what he needed . He requested to monitor the firewall which serviced the SQL and Web servers which is already being monitored by our cloud server . There was simply too much information coming in for the system to handle at one time. The actual requirement was to monitor our local firewall, which was already being done. We are using kiwi to do that with no problems. Thanks again. For informational purposes some of the answers to your questions are below.
1) As soon as I select a subscription and the process takes off, the system bogs down.
2) I have never been able to complete what I needed because it impacted other users too much. I have been able to use the "Applications" part of the wizard with no problem.
3) I am using Vista but going through a remote desktop to SQL server 2008.
Cancel
Vote Up 0 Vote Down

Cancel
0 pstoman over 11 years ago in reply to miles53

Although this post is very old I had the same issue and stumbled upon this.
Fortunately I found a solution to this problem. The thing is that when you have configured large log file size (512MB in my case) during initial setup Log forwarder try to read the whole log file and that's why there is an 100% cpu usage.
The solution is very simple delete all the events from log file through windows event viewer (save and then delete if you need history) and after that everything will be over in a second.
Hope this will help someone.
Tip for Solarwinds, maybe you could put some limitation on preview so that only 10-20 events are loaded during setup, and not whole log file.
Cancel
Vote Up 0 Vote Down

Cancel