Getting Data In

Universal Forwarder resource footprint estimation

pravesh_splunk
Engager

We are planning to implement Universal forwarder on Linux boxes having multiple clustered Weblogic domains. The applications on these domains (around 200 of them) generate 600 application log files placed on shared directory.
Can any one help me on how do I estimate the resource footprint of the Universal Forwarder that we are planning to install on these Linux servers. These application are business critical and having read about high CPU and memory consumption by Universal Forwarder, I wanted to make sure that the forwarder does not impact the applications.

Thanks

0 Karma

satishsdange
Builder

There is no definite number on how much resource is consumed by UF. Generally its <5% but that depends on what are you monitoring. Note that UF does not run any python scritpt, hence CPU load is less and it consumes less memory.
Based on the feedback received from one of the partner, its the lightest collector of all the solutions, he has seen so far.

0 Karma

pravesh_splunk
Engager

Thanks for your answer. I am also of the understanding that UF has the smallest resource footprint. And as you rightly mentioned, resource utilization would depend on what we are monitoring.
My application log (600 of them) could total up to 5GB before the switch. So does this mean that UF would need 5GB memory at the least?
Any guidelines/past experience on such estimation would be helpful.
Cheers

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...