Installation

Universal Forwarder's affect on the host server

swellerrific
Explorer

Howdy Splunkers! First post here.

I am looking for any information on the amount of resources a Universal Forwarder potentially uses on the server it is installed on when we are collecting IIS and/or winevent logs. All I can find in Splunk Community is "Universal forwarders use limited resources" which doesn't help me much.

As part of my onboarding process of bringing server logging into Splunk, I want to make sure that we consider the host resource usage as part of the considerations in the deployment planning in addition to the customary storage capacity those logs will need.

Currently, I need to install a UF on an IIS server which is extremely over-used and I want to try to understand how much the UF will add to the host server as I need to make sure the extra resource usage won't negatively affect or bring down the server.

I appreciate your time and hope this makes sense. Thank you so much for your help!

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

for my knowledgr, there isn't any ufficial benchmark by Splunk

In my experience I found (on Windows servers):

  • around 75-80 MB of RAM,
  • around 2% of CPU load,

Ciao.

Giuseppe

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @swellerrific,

Addition to @gcusello comments, memory usage can go higher if output data rate is higher than maxKBps  (default 256 KBps) value continuously.  On busy servers you should set it to higher or unlimited, keep monitoring the output and increase if necessary.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

swellerrific
Explorer

Thank you. I will have to research this as I am not sure how to monitor the output data (I assume it is on the IIS server itself). I appreciate your help. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

for my knowledgr, there isn't any ufficial benchmark by Splunk

In my experience I found (on Windows servers):

  • around 75-80 MB of RAM,
  • around 2% of CPU load,

Ciao.

Giuseppe

0 Karma

swellerrific
Explorer

Thank you both, I appreciate your replies. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @swellerrific,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...