Getting Data In

Universal Forwarder resource footprint estimation


We are planning to implement Universal forwarder on Linux boxes having multiple clustered Weblogic domains. The applications on these domains (around 200 of them) generate 600 application log files placed on shared directory.
Can any one help me on how do I estimate the resource footprint of the Universal Forwarder that we are planning to install on these Linux servers. These application are business critical and having read about high CPU and memory consumption by Universal Forwarder, I wanted to make sure that the forwarder does not impact the applications.


0 Karma


There is no definite number on how much resource is consumed by UF. Generally its <5% but that depends on what are you monitoring. Note that UF does not run any python scritpt, hence CPU load is less and it consumes less memory.
Based on the feedback received from one of the partner, its the lightest collector of all the solutions, he has seen so far.

0 Karma


Thanks for your answer. I am also of the understanding that UF has the smallest resource footprint. And as you rightly mentioned, resource utilization would depend on what we are monitoring.
My application log (600 of them) could total up to 5GB before the switch. So does this mean that UF would need 5GB memory at the least?
Any guidelines/past experience on such estimation would be helpful.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...