Getting Data In

Universal Forwarder resource footprint estimation

pravesh_splunk
Engager

We are planning to implement Universal forwarder on Linux boxes having multiple clustered Weblogic domains. The applications on these domains (around 200 of them) generate 600 application log files placed on shared directory.
Can any one help me on how do I estimate the resource footprint of the Universal Forwarder that we are planning to install on these Linux servers. These application are business critical and having read about high CPU and memory consumption by Universal Forwarder, I wanted to make sure that the forwarder does not impact the applications.

Thanks

0 Karma

satishsdange
Builder

There is no definite number on how much resource is consumed by UF. Generally its <5% but that depends on what are you monitoring. Note that UF does not run any python scritpt, hence CPU load is less and it consumes less memory.
Based on the feedback received from one of the partner, its the lightest collector of all the solutions, he has seen so far.

0 Karma

pravesh_splunk
Engager

Thanks for your answer. I am also of the understanding that UF has the smallest resource footprint. And as you rightly mentioned, resource utilization would depend on what we are monitoring.
My application log (600 of them) could total up to 5GB before the switch. So does this mean that UF would need 5GB memory at the least?
Any guidelines/past experience on such estimation would be helpful.
Cheers

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...