Splunk Search

Splunk Enterprise maximum local users?

season88481
Contributor

Hi

Could not find a setting in limits.conf OR authentication.conf. But is there a maximum number of local users we can create in a Splunk Enterprise instance?

Thanks.

0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

season88481
Contributor

very good answer. Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...