https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85861#M7341 <P>Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.</P> Fri, 05 Apr 2013 17:32:46 GMT gkanapathy 2013-04-05T17:32:46Z https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85859#M7339 <P>What's the recommended ulimit value for the universal forwarder on a unix machine? We started the forwarder and it warned about the limits that were set. </P> Fri, 05 Apr 2013 11:43:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85859#M7339 aaronkorn 2013-04-05T11:43:30Z https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85860#M7340 <P>The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.</P> Fri, 05 Apr 2013 17:31:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85860#M7340 gkanapathy 2013-04-05T17:31:30Z https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85861#M7341 <P>Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.</P> Fri, 05 Apr 2013 17:32:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/ulimit-on-forwarder/m-p/85861#M7341 gkanapathy 2013-04-05T17:32:46Z