Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec?

[Mag2sub]

We have a forwarder file monitor reading syslog files being churned out 10MB/sec...are there any tweaks to increase performance of the file monitor

Also this forwarder outputs to 2 indexers in LB mode ... do these block when both receivers go down ?

Appreciate inputs

[somesoni2]

You can set the thruput on the forwarder to unlimited by setting maxKBps attrubute. See below

http://answers.splunk.com/answers/7750/increase-throughput-limit-on-a-lightweight-forwarder.html

[Mag2sub]

To clarify this is a HWF? any suggestions for HWF
Other than performance
and any attributes for availability also appreciate ...for ex if both receivers go down ...does HWF block ?

[musskopf]

10Mb/s should be fine but remember that Universal Forwarders are limited to use only 256Kbp/s of bandwidth. Ref.: http://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.htm...