Installation

Universal Forwarder's affect on the host server

swellerrific
Explorer

Howdy Splunkers! First post here.

I am looking for any information on the amount of resources a Universal Forwarder potentially uses on the server it is installed on when we are collecting IIS and/or winevent logs. All I can find in Splunk Community is "Universal forwarders use limited resources" which doesn't help me much.

As part of my onboarding process of bringing server logging into Splunk, I want to make sure that we consider the host resource usage as part of the considerations in the deployment planning in addition to the customary storage capacity those logs will need.

Currently, I need to install a UF on an IIS server which is extremely over-used and I want to try to understand how much the UF will add to the host server as I need to make sure the extra resource usage won't negatively affect or bring down the server.

I appreciate your time and hope this makes sense. Thank you so much for your help!

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

for my knowledgr, there isn't any ufficial benchmark by Splunk

In my experience I found (on Windows servers):

  • around 75-80 MB of RAM,
  • around 2% of CPU load,

Ciao.

Giuseppe

View solution in original post

0 Karma

scelikok
Champion

Hi @swellerrific,

Addition to @gcusello comments, memory usage can go higher if output data rate is higher than maxKBps  (default 256 KBps) value continuously.  On busy servers you should set it to higher or unlimited, keep monitoring the output and increase if necessary.

 

If this reply helps you an upvote is appreciated.

swellerrific
Explorer

Thank you. I will have to research this as I am not sure how to monitor the output data (I assume it is on the IIS server itself). I appreciate your help. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

for my knowledgr, there isn't any ufficial benchmark by Splunk

In my experience I found (on Windows servers):

  • around 75-80 MB of RAM,
  • around 2% of CPU load,

Ciao.

Giuseppe

View solution in original post

0 Karma

swellerrific
Explorer

Thank you both, I appreciate your replies. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!