topic Re: Universal forwarders ingestion behind F5 LB in Getting Data In

Universal forwarders ingestion behind F5 LB

giuces — Sat, 09 Jan 2021 11:25:49 GMT

Hi guys,

I should find a solution to ingest a file on a network share that is managed from two server behind a load balancer. In my case i should install an UF on every server and check the same file, if i have well understood the UF has not a kind of cluster/balancing awareness so if the file is updated from one server i risk to have the same data ingested from both of them.
How i can manage this kind of behaviour and avoid that new data is ingested from the temporary passive server ?

Unfortunately i cannot use a third server to monitor the file and bypass the issue.

Thanks

Re: Universal forwarders ingestion behind F5 LB

richgalloway — Sat, 09 Jan 2021 13:34:10 GMT

If the file is available from both servers then only 1 UF needs to monitor it. The other UF must not monitor the same file or duplicate data is likely.

Re: Universal forwarders ingestion behind F5 LB

giuces — Mon, 11 Jan 2021 10:48:24 GMT

I Rich,

thank you for the reply. It is a valid solution, but in case i have to use UF in both nodes is there a possible workaround ?

thanks and regards

Re: Universal forwarders ingestion behind F5 LB

richgalloway — Mon, 11 Jan 2021 13:38:22 GMT

There is no workaround, which is why Splunk explicitly advises against monitoring the same directory/file by more than one forwarder.

Re: Universal forwarders ingestion behind F5 LB

giuces — Mon, 11 Jan 2021 15:26:00 GMT

thank you, i accepted the solution. I hope it is the right way to upvote it.

Re: Universal forwarders ingestion behind F5 LB

richgalloway — Mon, 11 Jan 2021 17:32:29 GMT

Accepting is good to mark a problem as solved so someone can find solutions in the future.
Upvote means clicking the Karma button.