About H4MID

H4MID · ‎01-11-2021

was great help, thank you! but in end, i did somthing else , i use NginX UDP Loadbalancer and 2xUF (with optimized configuration and OS improvment ) why UDP LB ? because use syslog-ng make my Storage busy Twice(write in syslog-ng + indexers) but we need to keep the storage(SAN) in low disk I/O and in other hand, i need events be on splunk soon as soon, so i send direct syslog stream to UFs and now i have 4,000,000,000 event on last 3days without event lost

H4MID · ‎01-02-2021

Hi i have a firewall that send syslog data to my splunk HF my problem is that when syslog stream data go high (over than 130mbps) , HF forward data at maximum 150mbps (shaped on network graph) and events loses there is no error or log that show what happen to my data or events on HF,UF,Indexers(no queue,bufer or connection error ,no splunkd.log error or warning) there is much Hardware Resource on all Splunk Cluster VMs: 12Core CPU(2.4Ghz) 20GB of Ram and SSD in all splunk VMs note (i dont use any event filtering or special process on data in HF in yet , just data get in and forward) is there any limit ? if yes what can i do with this scenario ?

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-02-2021

Online Status	Offline
Date Last Visited	‎01-11-2021 10:39 PM

forward data shaped on 150mbps and event loses

Re: forward data shaped on 150mbps and event loses

forward data shaped on 150mbps and event loses