I am wondering if there is a particular configuration for running the universal forwarder on a machine with limited resources and a CF card for it's disk storage, obviously I want to reduce the number of writes to the card. Is it possible to have the Splunk DB run in RAM memory instead of disk (windows XP embedded OS)?
Additionally will the UF client store events while the receiving indexer is offline?
Many thanks
hints :
It basically keep the pointer on the last line from the files that were monitored, and resume once the forwarding is restored. (and discover new files)
Yes, it will.
"the forwarder will simply pause the monitoring."
Sorry for the request for clarification - so it doesn't forward the event which occured while the client was disconnected?