Running high CPU load on your VMware cluster with Splunk – Leap Second Issue

On 30 June we experienced a ‘leap second’. This is a correctional measure for a time discrepancy. As IT guys, we don’t like time shifts. A lot of systems handle sudden time shifts poorly, even if it’s just for 1 second. If you use Splunk, you can run into such an issue.

If you are running Splunk on your VMware environment, you might experience higher CPU load caused by the Splunk daemon. The solution can be found here. In short, run these commands on the CLI of your host and you should see the CPU load going back into the green:

• /etc/init.d/ntp stop
• (date +“%H:%M:%S” |perl –pe ‘chomp’;echo `date +”%N”` / 999999999|bc –l) | sudo perl –ne ‘chomp;system (“date”,”-s”,$_);’
• /etc/init.d/ntp start

To check if all your VMware products are in line with the leap second step, check these two articles at the VMware Knowledgebase:

• Support for Leap Seconds in VMware Products (2115818)
• VMware products unaffected by the Leap Second change (2121624)