About yZinou

yZinou · ‎07-09-2020

Hello, We had a power outage after which our main Splunk instance (which serves as a Search Head and an Indexer) went offline, our Universal Forwarders installed on 2 Windows DC had both a huge memory usage after this causing one of these 2 hosts to crash. I think the inability to forward events properly caused queues to fill, but checking output.conf file shows an existing reduction setting of their size limit : "maxQueueSize = 100KB" (default is 500KB). My questions are : 1. What other steps can I take to prevent this ? (I prefer losing logs than having a critical host going offline). 2. Can I set a global memory usage limit for the Forwarders (like 2GB) ? 3. Could this be related to the Forwarders version (7.2.3) ? I thank you in advance for your support. Regards.

yZinou · ‎07-01-2020

Hello @Powers64, Thank you for sharing this script. I have a question please, I'm a bit confused by why should we specify {frozen-path}/{index-name}/{bucket_folder} as the path if the script is deleting from all indexes and not a single one ? I see that the this line ls -d */ -1 | cut -f1 -d'/' prior to the loop in your script allows listing of all indexes. Can you please confirm that path={frozen_path} (where all indexes with frozen buckets are) ? Thank you very much for your support. Regards.

Posts	2
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-01-2020

Online Status	Offline
Date Last Visited	‎07-10-2020 02:35 AM

High memory usage by Forwarders due to Indexer una...

High memory usage by Forwarders due to Indexer una...

Re: Frozen data deletion script - deletes older th...