ulimit on forwarder?

[aaronkorn]

What's the recommended ulimit value for the universal forwarder on a unix machine? We started the forwarder and it warned about the limits that were set.

[gkanapathy · Accepted solution]

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

[gkanapathy]

Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.