Heavy Forwarder stopped sending data

[3DGjos]

Hello,

Let's say we have Heavy Forwarder forwarding logs to groups A (Which consists of two IDX) and group B (One HF). Group B does not make LB, group A does.

My question is, what will the Heavy Forwarder do with the data if group A losses connectivity? Does the HF keep sending data to group B?

Thanks in advance.

[horaciob]

To clarify the query:
What happens in Splunk if there are two data sending groups (duplicating the information). If one of those groups (receiving Server) stops attending and quarantines the forwarder?
Stop sending data to the other group too?
Thank you

[skalliger]

You mean what happens when the Heavy Forwarder stops sending data to your indexers? Heavy Forwarders are able to buffer the data, depending on your configuration just like Universal Forwarders. When the connection is restored, the events will be sent to the indexers again. This works only with "useACK" enabled. You may need to adjust the settings on maxQueueSize though if you're expecting outages to happen.
Take a look at the outputs.conf documentation.

Skalli

[3DGjos]

Sorry, I wasn't clear in my first post. I mean, I want to know what happens if one of the groups, in my example group A, is quarantined due to connection lost or any other problem. In the example the HF is unable to send data to group A and puts it on quarantine. My question is... in this case, does the HF keeps sending the data to group B? even if it stopped sending the data to A due to quarantine? Because is my understanding that in this case it stores the data in buffer.

Thanks!

[skalliger]

Okay, now I got it.
Your heavy forwarder forwards data both to your indexers and another heavy forwarder. One question first, why would you do this?

If you define two stanzas in your outputs.conf, both sending targets will get their own output queue. So, if one target will be down, the queue will be blocked but the other target will still get the data.
Here is an example of this.

Skalli

[3DGjos]

Thanks for your answer skalliger, we have inherited the implementation. I have another question, bah, it's the same question but a little more specific.

we have:

[tcpout]
defaultGroup = A, B

[tcpout:A]
server=10.1.1.200:9999, 10.1.1.201:9991

[tcpout:B]
server=10.1.2.11:9996

Both groups have different output queues, so if group A losses connection, full data is sill sent to group B, can you confirm me that?

Thanks!