Monitoring Splunk

Universal Forwader - Cap CPU, memory, Disk usage

nhurtaud
Explorer

Hi everyone,
Thank you for your time. My question is sample:
is it possible to cap this three parameters:
- CPU
- RAM
- DISK
On a Universal Forwarder, installed like a agent for monitoring file and fschange. I think that UF don't write on Disk, just on RAM. is it true ?
I know that is possible to cap bitrate in output.conf and EventQueue, but for CPU and RAM footprinting of process itself, not Queue ?

Thank you and have a nice day.
Nicolas.

Tags (3)
0 Karma

jtrucks
Splunk Employee
Splunk Employee

This must be accomplished outside the Splunk application(s). Use OS level controls, so as ulimit settings on *Nix systems, or things like Cgroups in RHEL based systems.

--
Jesse Trucks
Minister of Magic

nhurtaud
Explorer

OK.
Thank you for your answer.
But, I regret not having the opportunity to cap CPU and RAM footprint.
Customers are worried.
Is it possible to gives some ideas for roadmap ?

Nicolas.

kranzrm
Path Finder

I second this. Worries are abound. We just had a DNS server crash and splunk-regmon was using almost 4GB of virtual memory.....

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...