Getting Data In

Why is my universal forwarder not respecting my limits.conf config?

daniel333
Builder

All,

I am have a simple app which just has this config in /default/limits.conf

[thruput]
maxKBps = 0

How can we get this event?

06-29-2016 20:32:01.257 +0000 INFO  ThruputProcessor - Current data throughput (258 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

Should be unlimited?

The only other limits.conf I have is the default

[root@MYSERVER apps]# find . -name limits.conf
./SplunkUniversalForwarder/default/limits.conf
./TA-COMPANY-int-limits.conf-thruput-unilimited/default/limits.conf
[root@MYSERVER apps]# 

UF version is 6.3.3

MuS
SplunkTrust
SplunkTrust

Hi daniel333,

the value of the ./SplunkUniversalForwarder/default/limits.conf is

#   Version 6.4.1
[thruput]
maxKBps = 256

and this take precedence over your TA 😉 S before T ...

Learn more about the Splunk config precedence here http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Wheretofindtheconfigurationfiles

and / or use btool to check the applied config:

/opt/splunkforwarder/bin/splunk btool limits list thruput --debug

Hope this helps ...

cheers, MuS

tkwaller
Builder

Correct me if I'm wrong though but it WILL take precedence if you put limits.conf in the app/local/ folder of the app you want to control limits.conf with. So you could quick fix it my moving limits.conf to the local folder of your unlimited TA and restarting splunkd.

Just a thought though 😃

MuS
SplunkTrust
SplunkTrust

@tkwaller : Yes, that would quick fix it as you can see here 😉

/opt/splunkforwarder/bin/splunk btool limits list thruput --debug
/opt/splunkforwarder/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/local/limits.conf [thruput]
/opt/splunkforwarder/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/local/limits.conf maxKBps = 0
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...