topic Universal Forwader - Cap CPU, memory, Disk usage in Monitoring Splunk

Universal Forwader - Cap CPU, memory, Disk usage

nhurtaud — Thu, 27 Jun 2013 09:48:23 GMT

Hi everyone,
Thank you for your time. My question is sample:
is it possible to cap this three parameters:
- CPU
- RAM
- DISK
On a Universal Forwarder, installed like a agent for monitoring file and fschange. I think that UF don't write on Disk, just on RAM. is it true ?
I know that is possible to cap bitrate in output.conf and EventQueue, but for CPU and RAM footprinting of process itself, not Queue ?

Thank you and have a nice day.
Nicolas.

Re: Universal Forwader - Cap CPU, memory, Disk usage

jtrucks — Thu, 15 May 2014 14:25:09 GMT

This must be accomplished outside the Splunk application(s). Use OS level controls, so as ulimit settings on *Nix systems, or things like Cgroups in RHEL based systems.

Re: Universal Forwader - Cap CPU, memory, Disk usage

nhurtaud — Fri, 30 May 2014 15:46:03 GMT

OK.
Thank you for your answer.
But, I regret not having the opportunity to cap CPU and RAM footprint.
Customers are worried.
Is it possible to gives some ideas for roadmap ?

Nicolas.

Re: Universal Forwader - Cap CPU, memory, Disk usage

kranzrm — Mon, 14 Dec 2015 14:57:47 GMT

I second this. Worries are abound. We just had a DNS server crash and splunk-regmon was using almost 4GB of virtual memory.....