The average load on our linux heavyforwarder is around 20, what can I do to reduce it and will increasing core count help in ways ?

[srampally]

The average load on our linux heavyforwarder is around 20. what can i do to reduce it and will increasing core count help in ways ?

what should be the ideal load range on a linux server running splunk enterprise as a heavy forwarder.

[nickhills]

Ha, an ideal server is one that runs at 99% all the time, but assuming your box does not have 20 cores, that is not ideal.

It depends on what is loading the box. Is it simply compute, in which case more cores will help, or do you have other constraints which are impacting on performance, such as memory, IO, network, or even loops and waits in scripts.

If you can give us an idea of what apps are running on it, we may be able to make some educated guesses, but as a general rule of thumb, more cores, should reduce the load average.

A shot in the dark, but the AWS TA fully configured to pull in all datasources is VERY heavy on the load avg. Dont run this alongside other apps if you can help it.