UF on linux server port requirement

[Thats_my_usrnme]

Hello Team,

I would like to install UF on Linux server but I got confused. Which one should I open "9997 for İndexer cluster and 8089 for deployment server" OR "9997 and 8089 for deployment server"? Can any body help about port requirement? 

[richgalloway]

Universal forwarders (UF) usually do not need to listen on any port since they typically read local files.  They can opt to read TCP data on any port or Splunk protocol on port 9997.

A UF must be able to connect to indexers on port 9997.  If you have several UFs, it's a good idea to use a Deployment Server (DS) to manage them.  UFs talk to the DS on port 8089.

[Thats_my_usrnme]

Hi Rich, I'm asking for sure. 9997 port for sending data and we have indexer cluster structure. What should be the port opening direction? Somebody says "you should open 9997,8089 for DS" and I asking WHY?. Because we are doing like this but its not a answer. Do the logs go to DS first and then get written to the indexer?

10.10.10.1 UF

10.10.10.2 DS

10.10.10.3 indexer cluster LB

1.Senario:

10.10.10.1 UF --9997,8089--> 10.10.10.2 DS

2.Senario:

10.10.10.1 UF --9997--> 10.10.10.3 indexer cluster

LB 10.10.10.1 UF --8089--> 10.10.10.2 DS

[richgalloway · Accepted solution]

The UF opens port 8089 on  the DS and port 9997 in the indexers.  Port 8089 is for management; port 9997 is for data/logs.

Data flows from UF directly to indexers, not via DS.

Do NOT put a load balancer between a UF and the indexers.

[Thats_my_usrnme]

Thanks for quick response Mr.Rich.