Monitoring Splunk

Universal Forwader - Cap CPU, memory, Disk usage

nhurtaud
Explorer

Hi everyone,
Thank you for your time. My question is sample:
is it possible to cap this three parameters:
- CPU
- RAM
- DISK
On a Universal Forwarder, installed like a agent for monitoring file and fschange. I think that UF don't write on Disk, just on RAM. is it true ?
I know that is possible to cap bitrate in output.conf and EventQueue, but for CPU and RAM footprinting of process itself, not Queue ?

Thank you and have a nice day.
Nicolas.

Tags (3)
0 Karma

jtrucks
Splunk Employee
Splunk Employee

This must be accomplished outside the Splunk application(s). Use OS level controls, so as ulimit settings on *Nix systems, or things like Cgroups in RHEL based systems.

--
Jesse Trucks
Minister of Magic

nhurtaud
Explorer

OK.
Thank you for your answer.
But, I regret not having the opportunity to cap CPU and RAM footprint.
Customers are worried.
Is it possible to gives some ideas for roadmap ?

Nicolas.

kranzrm
Path Finder

I second this. Worries are abound. We just had a DNS server crash and splunk-regmon was using almost 4GB of virtual memory.....

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...