Deployment Architecture

Is there Splunk Memory limit configuration?

YJ
Explorer

I am hoping someone could provide some comments/replies to check if we are able to limit the max memory usage for Splunk Universal Forwarders. If yes, Is the config filename "limit.conf" ?
Just to add also,
-Will there be any issues arising from limiting the memory usage?
-I understand we can also limit the memory usage(have not tested yet) on the OS level, any advantages/disadvantages?

Where can I also get a formal solution from Splunk which mentioned that the configuration is possible.

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

This is not supported natively in Universal Forwarder now. You could do this at OS/user levels. There will be negative impacts on performance if the forwarder workload requires memory more than the specified limit.

But you can optimize the forwarder workload, check this: https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-set-CPU-and-Memory-consumption-for-sp... 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that you could set max memory for UF (and also for splunk server) by systemd configuration. This needs that you update MemoryLimit parameter. Originally it has set when you enable boot start based on your host current memory.

I'm not sure if this can inform UF that don't try to use more memory than this or is it just for systemd for kill UF if it try to use more memory?

r. Ismo

0 Karma

YJ
Explorer

Hi,

Just to confirm/enquire more on this, what you meant is that we will be creating a service/script to run on the particular server ? Or there is already a Splunk default config file which  have the settings for us to edit. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

When you are enabling splunk boot start (please check exact syntax from docs) as systemd managed version, splunk create systemd config file into /etc/systemd/system. Its name is Splunk’s.service or something similar. You could change this if needed/wanted by splunk-launch.conf.

As I earlier said, when you are running that “splunk enable boot-start ….” as a root, it creates systemd conf file with standard values based on your host current physical attributes. If you want to restrict memory usage just decrease that memory parameter. I suppose that this restricts the Splunk’s memory usage.

0 Karma

manjunathmeti
Champion

This is not supported natively in Universal Forwarder now. You could do this at OS/user levels. There will be negative impacts on performance if the forwarder workload requires memory more than the specified limit.

But you can optimize the forwarder workload, check this: https://community.splunk.com/t5/Getting-Data-In/Is-there-a-way-set-CPU-and-Memory-consumption-for-sp... 

0 Karma

YJ
Explorer

Hi,

Thanks for the info.

"There will be negative impacts on performance if the forwarder workload requires memory more than the specified limit."  - This was also one of our concerns as we do have some UF that are configured to monitor quite a number of locations eg. > 20.  
In your experience, so far how much memory might be used in this case? 
So far I have seen Splunk services using up to 4GB on Windows server and impacting other constructs, but the cause was due to the Splunk UF installation was not installed properly and causing memory leak.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...