Universal Forwarder - Linux server - multiple processes running

[krusty]

Hi there,

maybe a simple question for the pros.
I have installed on different linux servers the UF to get logs and events.
I noticed on this servers that splunk is running with 40 processes (splunkd -p 8089 start) at the same time.
Is this a normal behavior?
Can a reduce the amount of running processes?

I'm using version 7.0.0 for the UF and the IDX.

Thanks!

[krusty · Accepted solution]

Hi mayurr98,

thanks for you response and the provided link.
But I think I found my mistake.

I was looking to the system processes via htop. htop shows to each process all associated threads. If I use ps -eHj I get also a process tree with child processes but whitout threads, and then I only see 3 processes.

So I have to apologize to wast your time with such a stupid question.
Sorry for that.

[mayurr98]

There is no complete list, because it depends on both your version of Splunk, the various scripts you may have and the searches that are running. But here is most of it

splunkd - this is the "engine" that does most of the work. The first splunkd process is the parent of all the other running Splunk processes
in Splunk 6.2, a second copy of splunkd runs to manage the user interface
a third copy of splunkd may run to collect information about how Splunk uses system resources
mongod - not in earlier versions, but starting in 6.2, this process manages the mongo db that contains the KV store
python - Splunk may run a python process

Splunk will also launch processes as needed to run scripted inputs, alert scripts and searches. These will be subprocesses of splunkd. Earlier versions of Splunk ran a splunkweb process, but that is no longer true in version 6.2
I found this answer in this doc

Also, have a look at this doc
https://answers.splunk.com/answers/177506/how-many-splunk-processes-are-normal-on-a-linux-in.html

let me know if this helps!