UF on a machine with Compact Flash Card

[markiemarkos]

I am wondering if there is a particular configuration for running the universal forwarder on a machine with limited resources and a CF card for it's disk storage, obviously I want to reduce the number of writes to the card. Is it possible to have the Splunk DB run in RAM memory instead of disk (windows XP embedded OS)?

Additionally will the UF client store events while the receiving indexer is offline?

Many thanks

[yannK]

hints :

• go to $SPLUNK_HOME/etc/log.cfg and reduce the number and size of the splunk internal logs to restrain them.
• the only "database" of the forwarder is the fishbucket index used to keep track of the files monitored, it is persistent and will grow proportionally of the number of files monitored.
• I do not know any way to have it run in memory, and it has to be on disk for persistence.
• about the queues, by default they are very small, and in memory, if the indexer is blocked, the forwarder will simply pause the monitoring.

[yannK]

It basically keep the pointer on the last line from the files that were monitored, and resume once the forwarding is restored. (and discover new files)

[Ayn]

Yes, it will.

[markiemarkos]

"the forwarder will simply pause the monitoring."

Sorry for the request for clarification - so it doesn't forward the event which occured while the client was disconnected?