Getting Data In

Limiting RAM CPU and Disk utilization on Universal Forwarder

aruncp333
Explorer

Hello Splunkers,

I want to know if we can limit the RAM, CPU and Disk utilization of a server where I have installed the Universal Forwarder.
Currently, based on my research I understand that the Bandwidth limit can be controlled using limits.conf.

Background: As I am installing the UF on my production server (*nix, Windows) I wouldn't want to choke the resource utilization on the server cuz of UF on it instead, I would like to limit the RAM and CPU utilization to 2-5% and Disk to 10-15%.

Thanks in advance.

0 Karma
1 Solution

masonmorales
Influencer

This is not something natively supported on the UF. You could look at OS-specific tools for controlling process resource utilization [of the UF/splunkd], but realize that it could have a negative impact on UF performance.

View solution in original post

0 Karma

masonmorales
Influencer

This is not something natively supported on the UF. You could look at OS-specific tools for controlling process resource utilization [of the UF/splunkd], but realize that it could have a negative impact on UF performance.

0 Karma

pruthvikrishnap
Contributor

There is one way to limit disk and ram utilization, you can do this by using Cgroup. below is a doc which speaks about it.
https://askubuntu.com/questions/836469/install-cgconfig-in-ubuntu-16-04

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...