Splunk Enterprise maximum local users?

[season88481]

Hi

Could not find a setting in limits.conf OR authentication.conf. But is there a maximum number of local users we can create in a Splunk Enterprise instance?

Thanks.

[inventsekar · Accepted solution]

i dont think there is a limit for maximum number of local users, (probably the Operating systems limit will apply i think)

in any case, we might never need to reach the maximum number of users.

from googled -

Limit for creating users:

Theoretically you can have as many users as the user ID space supports. To determine this on a particular system check out the definition of the uid_t type. It is usually defined as unsigned_int or int. On intel architectures, sizes are defined in /usr/include/bits/typsizes.h. You can check value of this variable in your system by typing following command on terminal

cat /usr/include/bits/typesizes.h | grep UID_T

In my system, output of this command shows:

#define __UID_T_TYPE   __U32_TYPE

This means system can host 4294967296 (2^32) different users. However, other resources may become exhausted before you reach this limit, e.g. disk space. If you create a home directory for each user then even with just 1MB of space for each user you need over 4PBs of storage. Also, large number of users leaving processes running in the background, scheduling cron jobs, opening ftp and/or ssh sessions can create a severe burden on the system.

Limit for simultaneous logins:

When logging in using SSH, you use a pseudo-terminal (a pty) allocated to the SSH daemon, not a real one (a tty). Pseudo-terminals are created and destroyed as needed. You can find the number of ptys allowed to be allocated at one time by

cat /proc/sys/kernel/pty/max

In my system, output of this command shows:

4096

This means 4096 users can simultaneously login on this machine (remote login).

PS: My Linux distribution is 64-bit Fedora 23

[season88481]

very good answer. Thanks.