topic Re: Optimising CPU + RAM usage on Universal Forwarder in Getting Data In

Optimising CPU + RAM usage on Universal Forwarder

DavidHourani — Wed, 23 Aug 2017 13:57:37 GMT

Hello guys,

I've been looking around in the questions and most of them are about forwarders causing High CPU because of some bug or some misconfiguration. My questions is about optimising and tweaking a universal forwarder that is working well in order to reduce its CPU impact.

So anyone who has tips and tricks to share it will be very much welcome. Even if you have system level tips for linux/windows it's also welcome!

Best regards,
David

Re: Optimising CPU + RAM usage on Universal Forwarder

ddrillic — Wed, 23 Aug 2017 14:29:58 GMT

Good information at -

Search please for the forwarder parts...

Re: Optimising CPU + RAM usage on Universal Forwarder

DavidHourani — Wed, 23 Aug 2017 15:04:39 GMT

What do you mean ? did you post any link because I cant see anything 🙂

Re: Optimising CPU + RAM usage on Universal Forwarder

mdessus_splunk — Wed, 23 Aug 2017 20:58:29 GMT

Hi David,

Do you have any specific issues ? On which system ? When collecting what kind of data ?
Can you give some details ?

Re: Optimising CPU + RAM usage on Universal Forwarder

DavidHourani — Fri, 25 Aug 2017 09:44:09 GMT

Hello Mathieu, hope you're well 🙂

I have FWDs running on windows DC and I want to set limits to make sure that they never go over 5% CPU even if that means slowing down log collection.
Any idea on how that could be done ?
Cheers,
David

Re: Optimising CPU + RAM usage on Universal Forwarder

mdessus_splunk — Fri, 01 Sep 2017 15:22:34 GMT

I'm not sure there is a prefect answer for your question. By default, the fwd is designed to have a very limited impact on the system. You can limit the inputs to the ones that match your needs.
You might also look at windows system features.

Of course, you can monitor CPU usage in Splunk 🙂

Re: Optimising CPU + RAM usage on Universal Forwarder

robertlynch2020 — Tue, 19 Feb 2019 14:44:54 GMT

I have the same issues, do you find a solution