How can we handle forwarders on highly-utilized servers?

[ddrillic]

We have all kinds of issues when a forwarder is installed on a highly-utilized server, such as a DB Linux server due to running out of resources on this type of servers. I wonder which alternatives we can use for the forwarder in such cases.

[ddrillic]

Btw, is there a way to limit the amount of memory Splunk uses on a server?

[esix_splunk]

What are you monitoring on this server with the Forwarder? Are you running the NIX TA to get CPU / Mem / Disk performance metrics? Or are you just reading log files?

If you're collecting metrics from the OS, you might look at collectd as an alternative for collecting the metrics, and send that to Splunk.

If you're just reading log files, you could setup syslog to forward those logs to another server and then use a forwarder there to read the files.

[ddrillic]

-- If you're just reading log files, you could setup syslog to forward those logs to another server and then use a forwarder there to read the files.

Very interesting.

[dedwards93]

Try to use the least wildcards as possible in your inputs.conf
The more wildcards you use to tell the forwarder where to search for logs, the more resources it needs.

Avoid uses of /.../ as much as you can. This will reduce the amount of resource the forwarder requires.