Universal Forwarder's affect on the host server

[swellerrific]

Howdy Splunkers! First post here.

I am looking for any information on the amount of resources a Universal Forwarder potentially uses on the server it is installed on when we are collecting IIS and/or winevent logs. All I can find in Splunk Community is "Universal forwarders use limited resources" which doesn't help me much.

As part of my onboarding process of bringing server logging into Splunk, I want to make sure that we consider the host resource usage as part of the considerations in the deployment planning in addition to the customary storage capacity those logs will need.

Currently, I need to install a UF on an IIS server which is extremely over-used and I want to try to understand how much the UF will add to the host server as I need to make sure the extra resource usage won't negatively affect or bring down the server.

I appreciate your time and hope this makes sense. Thank you so much for your help!

[scelikok]

Hi @swellerrific,

Addition to @gcusello comments, memory usage can go higher if output data rate is higher than maxKBps  (default 256 KBps) value continuously.  On busy servers you should set it to higher or unlimited, keep monitoring the output and increase if necessary.

[swellerrific]

Thank you. I will have to research this as I am not sure how to monitor the output data (I assume it is on the IIS server itself). I appreciate your help. 

[gcusello · Accepted solution]

Hi @swellerrific,

for my knowledgr, there isn't any ufficial benchmark by Splunk

In my experience I found (on Windows servers):

• around 75-80 MB of RAM,
• around 2% of CPU load,

Ciao.

Giuseppe

[swellerrific]

Thank you both, I appreciate your replies. 

[gcusello]

Hi @swellerrific,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉