topic Re: Hardware requirement for intermediate forwarder server in Getting Data In

Hardware requirement for intermediate forwarder server

Thang_TV — Fri, 30 Apr 2021 03:52:54 GMT

Hi Everyone,

I want to know hardware requirement for intermediate forwarder server.

CPU, DISK, RAM.

Thanks !

Re: Hardware requirement for intermediate forwarder server

gcusello — Fri, 30 Apr 2021 05:29:56 GMT

Hi @Thang_TV,

there isn't an explicit hardware reference for Heavy Forwarders, this means that (to be sure) you should take the hardware reference for a stand alone Splunk Server: 12 CPUs and 12 GB RAM.

If you have availabilità it's better to give these resources to your virtual machine.

If instead you haven't availability and you analyzed that you haven't an hard work for it, you could try with 8 CPUs and 8 GB RAM, monitoring it to understand if it reach to do its work.

The thing to analyze are: log parsing and eventual management of external syslog output queue.

In my experince, usually it's sufficient and I always start with these resources; only one time I had to give more resources because I saw that the HF was in trouble (slow queues) to do a very hard work: receive logs from some Universal Forwarders and syslogs from some appliances, parse them, manage an output syslog queue very large.

About hard disks, it's an intermediate Forwarder without local indexing, you can give 30 GB, or (better) 50.

Ciao.

Giuseppe

Re: Hardware requirement for intermediate forwarder server

Thang_TV — Fri, 30 Apr 2021 09:08:16 GMT

Hi Giuseppe,

Thank for your helpful answer,

I have one more questions, please clear it for me:

1. Does only HF support intermediate forwarder ? how about Universal forwarder ?

2. When intermediate forwarder received logs like: Syslog from Firewall, IPS, Router.... and other log from universal forwarder. What will the intermediate forwarder do ?

- Storage the log and forward to Indexer, after that, deleted the logs ?

- Just forward the log, not storage logs ?

Thanks !

@gcusello