We have a forwarder file monitor reading syslog files being churned out 10MB/sec...are there any tweaks to increase performance of the file monitor
Also this forwarder outputs to 2 indexers in LB mode ... do these block when both receivers go down ?
Appreciate inputs
You can set the thruput on the forwarder to unlimited by setting maxKBps attrubute. See below
http://answers.splunk.com/answers/7750/increase-throughput-limit-on-a-lightweight-forwarder.html
To clarify this is a HWF? any suggestions for HWF
Other than performance
and any attributes for availability also appreciate ...for ex if both receivers go down ...does HWF block ?
10Mb/s should be fine but remember that Universal Forwarders are limited to use only 256Kbp/s of bandwidth. Ref.: http://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.htm...