Hello,
We had a power outage after which our main Splunk instance (which serves as a Search Head and an Indexer) went offline, our Universal Forwarders installed on 2 Windows DC had both a huge memory usage after this causing one of these 2 hosts to crash.
I think the inability to forward events properly caused queues to fill, but checking output.conf file shows an existing reduction setting of their size limit : "maxQueueSize = 100KB" (default is 500KB).
My questions are :
1. What other steps can I take to prevent this ? (I prefer losing logs than having a critical host going offline).
2. Can I set a global memory usage limit for the Forwarders (like 2GB) ?
3. Could this be related to the Forwarders version (7.2.3) ?
I thank you in advance for your support.
Regards.
