Hi all,
I have 2 tcpout groups on my servers sending data to 2 distinct sets of indexers. A number of servers recently lost access to one of those 2 indexer (tcpout) groups. For the sake of an example, lets say tcpout group 1 was available and group 2 was not.
During this time we saw the Universal forwarders buffering data for group 2 as it's not available. This then filled the buffer and paused the UF - so no data was being sent to group 1, despite it being available.
We have useAck set to true for both groups and the log files caught up, but we lost any 'live' data (generated from Powershell and Perfmon).
My question is: is it possible to have separate buffers on 2 different tcpout groups? So that the filling of one, doesn't affect the other. Failing this, I expect it'll be a case of simply increasing the buffer value to allow more tolerance to failure. However, given the volume of traffic, it wouldn't take long to fill even a large buffer.
Any other suggestions?
