Getting Data In
Highlighted

Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec?

Path Finder

We have a forwarder file monitor reading syslog files being churned out 10MB/sec...are there any tweaks to increase performance of the file monitor

Also this forwarder outputs to 2 indexers in LB mode ... do these block when both receivers go down ?

Appreciate inputs

0 Karma
Highlighted

Re: Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec?

Builder

10Mb/s should be fine but remember that Universal Forwarders are limited to use only 256Kbp/s of bandwidth. Ref.: http://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.htm...

0 Karma
Highlighted

Re: Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec?

SplunkTrust
SplunkTrust

You can set the thruput on the forwarder to unlimited by setting maxKBps attrubute. See below

http://answers.splunk.com/answers/7750/increase-throughput-limit-on-a-lightweight-forwarder.html

0 Karma
Highlighted

Re: Are there any ways to increase the performance of our forwarder's current file monitor reading syslog files at 10MB/sec?

Path Finder

To clarify this is a HWF? any suggestions for HWF
Other than performance
and any attributes for availability also appreciate ...for ex if both receivers go down ...does HWF block ?

0 Karma