Monitoring Splunk

ulimit on forwarder?

aaronkorn
Splunk Employee
Splunk Employee

What's the recommended ulimit value for the universal forwarder on a unix machine? We started the forwarder and it warned about the limits that were set.

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The ulimit that your warning is complaining about is not the file handles ulimit (-n), which is what people usually mean when they just say "ulimit". It's the data segment, I.e., memory allowed for the splunkd process. 128 megabytes total and 32 megabytes for resident memory is really tight. You should increase it to at least 4 or 8 times that, and maybe more if you're running a lot of collection scripts, monitoring a lot of files, or have set the buffers/queues larger. That's conservative, I probably would just set them at 2 or 4 GB if they'll let you.

gkanapathy
Splunk Employee
Splunk Employee

Also, Splunk raises the ulimit to the hard limit max, so the soft limit doesn't matter. To raise the hard limit, you need root.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...