Splunk Search

Splunk Enterprise maximum local users?

season88481
Contributor

Hi

Could not find a setting in limits.conf OR authentication.conf. But is there a maximum number of local users we can create in a Splunk Enterprise instance?

Thanks.

0 Karma
1 Solution

inventsekar
Ultra Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

View solution in original post

inventsekar
Ultra Champion

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

season88481
Contributor

very good answer. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...