All Apps and Add-ons

What happens when the UF service is stopped?

sjcoluccio67
Explorer

I have UFs deployed to many systems monitoring Windows event logs. I need to stop the SplunkForwarder service on some of these systems for about a day to do some testing. Will the UF pick back up from where it left off in the event logs or will I lose the logs from the day that the service is stopped? Does the UF queue up incoming logs while it is stopped or does it have a place marker that it goes back to in the logs once it is turned back on?

1 Solution

sudosplunk
Motivator

Splunk has something called fishbucket which keeps track of what data is indexed. With help of this, as long as the logs are not rolled over, UF will pick up where it left off.

Persistent queuing lets you store data in an input queue to disk. This can help prevent data loss if the forwarder or indexer gets backed up. You can use this setting to store any data in flight to disk.

By default, forwarders and indexers have an in-memory input queue of 500KB.

Please refer to this link for more information about how monitor processor works.

View solution in original post

ddrillic
Ultra Champion

A place marker describes it well ; - )

0 Karma

sudosplunk
Motivator

Splunk has something called fishbucket which keeps track of what data is indexed. With help of this, as long as the logs are not rolled over, UF will pick up where it left off.

Persistent queuing lets you store data in an input queue to disk. This can help prevent data loss if the forwarder or indexer gets backed up. You can use this setting to store any data in flight to disk.

By default, forwarders and indexers have an in-memory input queue of 500KB.

Please refer to this link for more information about how monitor processor works.

akocak
Contributor

if you stop forwarder from CLI, i believe it should send what it has in its buffer and then stop the service.
When you re-start the service after your maintenance, it will continue by looking fishbucket index which holds file read information ( where to continue reading etc... ) . Therefore, you should NOT be missing any data from outage unless you have some logs disappears due to log rotation etc..

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...