Monitoring Splunk

ulimit on forwarder?

aaronkorn
Splunk Employee
Splunk Employee

What's the recommended ulimit value for the universal forwarder on a unix machine? We started the forwarder and it warned about the limits that were set.

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

gkanapathy
Splunk Employee
Splunk Employee

Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...