topic Re: How can we handle forwarders on highly-utilized servers? in Getting Data In

How can we handle forwarders on highly-utilized servers?

ddrillic — Sun, 28 Jan 2018 19:32:47 GMT

We have all kinds of issues when a forwarder is installed on a highly-utilized server, such as a DB Linux server due to running out of resources on this type of servers. I wonder which alternatives we can use for the forwarder in such cases.

Re: How can we handle forwarders on highly-utilized servers?

dedwards93 — Sun, 28 Jan 2018 22:46:33 GMT

Try to use the least wildcards as possible in your inputs.conf
The more wildcards you use to tell the forwarder where to search for logs, the more resources it needs.

Avoid uses of /.../ as much as you can. This will reduce the amount of resource the forwarder requires.

Re: How can we handle forwarders on highly-utilized servers?

esix_splunk — Mon, 29 Jan 2018 05:54:11 GMT

What are you monitoring on this server with the Forwarder? Are you running the NIX TA to get CPU / Mem / Disk performance metrics? Or are you just reading log files?

If you're collecting metrics from the OS, you might look at collectd as an alternative for collecting the metrics, and send that to Splunk.

If you're just reading log files, you could setup syslog to forward those logs to another server and then use a forwarder there to read the files.

Re: How can we handle forwarders on highly-utilized servers?

ddrillic — Mon, 29 Jan 2018 12:10:32 GMT

-- If you're just reading log files, you could setup syslog to forward those logs to another server and then use a forwarder there to read the files.

Very interesting.

Re: How can we handle forwarders on highly-utilized servers?

ddrillic — Mon, 05 Feb 2018 16:45:38 GMT

Btw, is there a way to limit the amount of memory Splunk uses on a server?