Splunk Search

Splunk Enterprise maximum local users?

season88481
Contributor

Hi

Could not find a setting in limits.conf OR authentication.conf. But is there a maximum number of local users we can create in a Splunk Enterprise instance?

Thanks.

0 Karma
1 Solution

inventsekar
Ultra Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

View solution in original post

inventsekar
Ultra Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

season88481
Contributor

very good answer. Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...