Hi,
I have a single licensed indexer running on a server.
I also have installed a universal forwarder to collect and send data from another site.
There is a 50Mpbs link between the sites, but I am only seeing about 15-30kBps from the forwarder to the indexer.
How do I make it go faster / why is it going so slowly.
CPU, Memory and network all are fine (CPU is hardly used). I can send data manually to the indexer - I scp'd a file there at 10x the transfer speed I'm seeing.
On the forwarder I have checked the limits.conf and edited this to override the 256kBps limit - I've tried:
[thruput]
maxKBps = 1000000000
and
maxKBps = 0
I observe in the forwarder metrics.log that the parsingqueue was getting full so I increased it (and the other queues) but it is still getting blocked:
07-17-2012 13:59:01.449 +0100 INFO Metrics - group=queue, name=parsingqueue, blocked=true, max_size_kb=102400, current_size_kb=102399, current_size=133403, largest_size=133403, smallest_size=133365
07-17-2012 13:59:01.449 +0100 INFO Metrics - group=queue, name=tcpout_my_indexer_9997, max_size=51200000, current_size=51181970, largest_size=51199992, smallest_size=51174808
Interestingly the tcpout queue seems to be permanently full like this.
Is there anything else limiting the speed? Can the indexer be limiting the speed that the forwarder can send to it?
Any help appreciated.
