https://community.splunk.com/t5/Getting-Data-In/High-memory-usage-by-Forwarders-due-to-Indexer-unavailability/m-p/508331#M86496 <P>Hello,</P><P>We had a power outage after which our main Splunk instance (which serves as a Search Head and an Indexer) went offline, our Universal Forwarders installed on 2 Windows DC had both a huge memory usage after this causing one of these 2 hosts to crash.</P><P>I think the inability to forward events properly caused queues to fill, but checking output.conf file shows an existing reduction setting of their size limit : "maxQueueSize = 100KB" (default is 500KB).</P><P>My questions are :</P><P>1. What other steps can I take to prevent this ? (I prefer losing logs than having a critical host going offline).<BR />2. Can I set a global memory usage limit for the Forwarders (like 2GB) ?<BR />3. Could this be related to the Forwarders version (7.2.3) ?</P><P>I thank you in advance for your support.</P><P>Regards.</P> Thu, 09 Jul 2020 15:38:40 GMT yZinou 2020-07-09T15:38:40Z https://community.splunk.com/t5/Getting-Data-In/High-memory-usage-by-Forwarders-due-to-Indexer-unavailability/m-p/508331#M86496 <P>Hello,</P><P>We had a power outage after which our main Splunk instance (which serves as a Search Head and an Indexer) went offline, our Universal Forwarders installed on 2 Windows DC had both a huge memory usage after this causing one of these 2 hosts to crash.</P><P>I think the inability to forward events properly caused queues to fill, but checking output.conf file shows an existing reduction setting of their size limit : "maxQueueSize = 100KB" (default is 500KB).</P><P>My questions are :</P><P>1. What other steps can I take to prevent this ? (I prefer losing logs than having a critical host going offline).<BR />2. Can I set a global memory usage limit for the Forwarders (like 2GB) ?<BR />3. Could this be related to the Forwarders version (7.2.3) ?</P><P>I thank you in advance for your support.</P><P>Regards.</P> Thu, 09 Jul 2020 15:38:40 GMT https://community.splunk.com/t5/Getting-Data-In/High-memory-usage-by-Forwarders-due-to-Indexer-unavailability/m-p/508331#M86496 yZinou 2020-07-09T15:38:40Z