Monitoring Splunk

ulimit on forwarder?

aaronkorn
Splunk Employee
Splunk Employee

What's the recommended ulimit value for the universal forwarder on a unix machine? We started the forwarder and it warned about the limits that were set.

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

gkanapathy
Splunk Employee
Splunk Employee

Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...