Getting Data In

What can be the effects of rebooting a server without taking the forwarder down cleanly?

danielbb
Motivator

Many of the forwarders here go down when the servers go for maintenance work. What can go wrong with the forwarders when we don't shut them down cleanly?

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

View solution in original post

adonio
Ultra Champion

I think the main thing that can happen is that they wont start up properly.
other then that, if you have scripted inputs, the scripts wont run, for monitor data, you will resume to (or close) the point where the forwarder stopped.
if its using as an aggregation, meaning. intermediate forwarder, then youll probably lose data

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...