Description

app-log records below log lines:

06-18-2024 05:43:20.019 +0200 WARN DispatchManager [1843 SchedulerThread] - Search not executed: reason="The maximum disk usage quota for this user has been reached.", usage=108MB, quota=100MB, user=admin
06-18-2024 05:43:20.019 +0200 WARN DispatchManager [1843 SchedulerThread] - Failed to start search for sid="scheduler__admin_c2VjdXJld2F0Y2hfYW5hbHl0aWNzX3RkZA__RMD5781f339941ca8c5f_at_1718682180_146". Dropping failedtostart token at path=/opt/splunk/var/run/splunk/dispatch/scheduler__admin_c2VjdXJld2F0Y2hfYW5hbHl0aWNzX3RkZA__RMD5781f339941ca8c5f_at_1718682180_146 to expedite dispatch cleanup

Symptoms

app-log prints the WARNING messages
No errors or Warnings on the CMS UI or Portal
With the Disk usage Warning user experiences slowness while accessing the web UI

Solution

Check for SecureWatch connectivity for syncing the Telemetry Data.

The data is stored locally and if SwcureWatch is not Installed or the connection is broken the files will be piled causing Disk Usage Alerts.

Please note: SecureWatch server(s) will be connected over VPN on TCP port 443 to one of these IPs 3.13.10.107, 35.155.55.233, 35.158.5.95, 13.127.221.235.
Please ensure your firewall allows outbound TCP connection ( destination port 443 ) to 3.13.10.107, 35.155.55.233, 35.158.5.95, 13.127.221.235.

Modification History

2024-07-26 : Article Created