We have a forwarder file monitor reading syslog files being churned out 10MB/sec...are there any tweaks to increase performance of the file monitor
Also this forwarder outputs to 2 indexers in LB mode ... do these block when both receivers go down ?
10Mb/s should be fine but remember that Universal Forwarders are limited to use only 256Kbp/s of bandwidth. Ref.: http://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.htm...
To clarify this is a HWF? any suggestions for HWF
Other than performance
and any attributes for availability also appreciate ...for ex if both receivers go down ...does HWF block ?