Of course a forwarder must consume some resources on any system it is monitoring. We have worked hard to make sure that it's footprint is minimal. A UF when monitoring a reasonable set of log files (or Event Logs) typically will use less than 1% of a CPU and maybe 30 MB of memory. This amount can be higher if you, for example: monitor many tens of thousands of files with many changing files; increase the thruput limit on the forwarder; install addons that consume additional CPU or memory to collect other types of data sources.
