topic Re: Can I set Splunk Forwarder Memory Use Limit? in Getting Data In

Can I set Splunk Forwarder Memory Use Limit?

wbfoxii — Thu, 25 Apr 2013 14:38:37 GMT

We have forwarders installed on our Domain Controllers to get the Windows event logs. Our Domain Admin is excited about memory usage. Is there a setting in limits.conf that would allow me to cut down the amount of memory the forwarder uses? I'm seeing 2 GB being held by the forwarder based on looking at the memory use graph before and after stopping the forwarder service.

I've seen documentation that says the forwarder does not hold the memory "tightly" and would release it to other tasks. Is there any discussion on how that works?

Re: Can I set Splunk Forwarder Memory Use Limit?

cdupuis123 — Mon, 01 Jul 2013 16:45:24 GMT

You ever get an answer on this? Reasearching a simular complaint currently.....

Re: Can I set Splunk Forwarder Memory Use Limit?

wbfoxii — Tue, 26 Aug 2014 14:17:59 GMT

Never got an answer on this. Now I'm waiting for the next event to get a DIAG and open a ticket with support.

Admin is still excited. It makes the DC unresponsive until the forwarder is restarted.