expand heavy forwarder

[raindrop18]

My logs volume increased and notice time out on my heavy forwarder, which is best way to add capacity increase the size of the server (more powerful server) or add multiple server. on the other word escaling horizontally vs vertically.

[Javip · Accepted solution]

ummm...

Have a look to your HF queues using DMC, perhaps HF is unable to handle all this incomming data from your 3k UFs.
Have a look to limits.conf file also.

Let me know if you find the problem there finally.

J.

[raindrop18]

Ok. I will and let you know but the bottom line is HF can't expand horizontally as Indexer?

[Javip]

yes, if necessary, you can have 2 HFs and you can send them balanced data from your UFs

[Javip]

Hi,

do you have CPU, memory, filesystem free space stats for this HF?
Do you use it only to pass data from your UFs to your IXs or you do more tasks there (i.e. Db connect, ...)?

If you provide all that info (or even more details) we can suggest you better solutions 😉

Regards,
J.

[raindrop18]

thanks J. the current server not indicate any cpu or memory issue, the metrics for that is low only network input out put is high as high traffic coming to the HF, I am using the HF as HEC also. most of the time out is on the logs pushed over HEC.

[p_gurav]

Are you using heavy forward for filtering data or as center server to pass data?

[raindrop18]

mainly to pass data not filtering.

[p_gurav]

Also is there any error in _internal logs for heavy forwarder? Is there any firewall in between?

[raindrop18]

No firewall, I don't see any error. but on UF I see traffic is on waiting state. BTW I have close to 3k UF forward the logs to The HF. and HEC.