VMware Log Insight 2.0 GA very high CPU when using interactive analytics and Windows content Pack installed

[pboguszewski]

Hi all, I am seeing 100% CPU use and no log information when in Interactive Analytics after installing the Windows Content Pack v 1.0.201406101414.  I remove the content pack and all goes back to normal.  I am on version 2.0 GA (2.0.3-1879692).  I never had the content pack installed before upgrading to this version last week.  Thanks for any help.

[sflanders]

Can you provide any more details? I assume you access the Dashboards page (Windows content pack) and Interactive Analytics page in separate tabs/browsers at the same time? Which dashboard of the Windows content pack are you looking at? Are the queries completing or continuing to spin? If continuing to spin, which ones? What are the resources on the VA (CPU/MEM)?

[billrothjr]

Sounds like you should call support.

[pboguszewski]

The CPU spikes and events do not display when I get to the interactive analytics page (unless it is through the Windows dashboard).  I not tab browsing for testing purposes. I enter the Interactive Analytics page by clicking on the top menu selection (not through the dashboard at all) and the graph displays but no events at all.  It simply sits and the little circular status icon spins.  No results appear no matter the length of wait.  Now the interesting part...  When I go to the Windows dashboard and select a bar from one of the dashboard widgets then choose the interactive analytics dropdown the events do in fact show up!  I change the channel filter, from 'contains' to 'does not contain', system, application, security it ramps up CPU and never completes.

[pboguszewski]

The VM has 4 vCPUs and 8gb of RAM.  The problem immediately goes away when I remove the Windows content pack.

[sflanders]

Interesting indeed. The title says 2.0 GA, but the tag is 2.0-beta. Assuming this is 2.0 GA, I would recommend a support case. Let me know the SR number after you create one.

[pboguszewski]

Support Request Confirmation Number: 14492512406

[sflanders]

This should be resolved with the updated Windows content pack -- can you confirm?